search

TASVideos / tasvideos

The code for the live TASVideos website
https://tasvideos.org/
GNU General Public License v3.0
62 stars 29 forks source link

Role editing grants unexpected privileges #1690

Closed moozooh closed 1 year ago

moozooh commented 1 year ago

As a Senior Moderator, I'm able to remove any existing role, including the Site Admin role, by either unchecking it or pressing the "x" next to it. Doesn't matter if I don't have permissions to set it in the first place.

example

Masterjun3 commented 1 year ago

Important to note that this is purely a visual bug! The server properly checks it again, and throws away changes that are not authorized. Good news: People can't grant more roles than they are allowed. Bad news: People can take away every role.