search

cubecart / v6

CubeCart Version 6
https://cubecart.com
72 stars 57 forks source link

Non-Super Can Make Itself Super #2005

Closed bhsmither closed 6 years ago

bhsmither commented 6 years ago

In a round-about way-- A non-super-user can create a code snippet (needs Settings:Edit permission), that tweaks the CubeCart_admin_users table by updating their record 'super_user' = 1.

Suggest in settings.hooks.inc.php, change permissions('settings' to permissions('maintenance'.

Therefore, since there is no section called 'maintenance' in Admin->_getSectionId), only a Super User can get access to admin, Manage Hooks.

And, since there is no CC_PERM_FULL in Admin->_convertPermission(), only a Super User can get full access. No, wrong context.

abrookbanks commented 6 years ago

Code Snippet should be SU only really. I'll get this fixed.