search

flarum / issue-archive

0 stars 0 forks source link

edit a user without "view hidden group bages" permission can break membership of the user #150

Open Ornanovitch opened 3 years ago

Ornanovitch commented 3 years ago

discuss ref

Bug Report

Current Behavior When a user has the edit users permission but doesn't have the view hidden group badges one, he can involuntary kick off users from group with a hidden badge simply by add them or remove them to/from an other group.

Steps to Reproduce

  1. make 3 groups and 2 users group A has the Edit user groups permission but doesn't have the View hidden group badges one group B has the Hide on forum attribute group C is a control group without special attribute nor permission
  2. add @user1 to group A (can edit user groups) and @user2 to group B (hidden badge)
  3. with @user1, edit @user2 and add him to group C.
  4. @user2 is kicked off the group B

Expected Behavior @user2 should remains into group B.

Environment nightly