search

intelliants / subrion

Subrion CMS - open source php content management system.
https://subrion.org/
GNU General Public License v3.0
282 stars 119 forks source link

Permissions system for new user groups does not work correctly. #260

Open olairmarcos opened 7 years ago

olairmarcos commented 7 years ago

I posted this problem in the forum, I had no answer. I will post here again. Permissions system for new user groups does not work correctly. How to test: 1- Create a new user group. Copy administrator permissions. 2016-12-29_231701 -New user group created. 2016-12-29_231800 -Manually configure the permissions (frontpage). 2016-12-29_232114 -Manually configure the permissions (panel control). 2016-12-29_232835

2- Add a new user to the new group. 2016-12-29_233329 -New user created. 2016-12-29_233356 -See configuration the permissions (frontpage). 2016-12-29_233441 -See configuration the permissions (panel control). 2016-12-29_233534

3- Test the permissions of the new user in the control panel. Content > Pages = Working Dashboard > Uploads = Working All other settings have a 403 error, when we try to configure it on the control panel. I see that the permissions user for the new user groups do not work correctly.

Thank you for listening.

ghost commented 7 years ago

Thanks for such a detailed report @olairmarcos. We will check it.

ghost commented 7 years ago

Partially duplicates and references to #237 which has been solved.

ghost commented 7 years ago

Unable to reproduce, everything works fine.

vbezruchkin commented 7 years ago

@Batry the problem exists. Follow the instructions as described.

  1. Create usergroup Managers based on admin permissions
  2. Create a new user of Managers group
  3. Try to login to admin dashboard

I am unable to login as admin. Check permissions after usergroup creation - they are not similar to administrator permissions. Recheck carefully, @Batry

vbezruchkin commented 7 years ago

Yep, default permissions for usergroups are incorrect. Here is the way to go:

  1. There should be only one administrators usergroup - prevent permissions creation on top of this group. Delete it from the dropdown on create usergroup page.
  2. Recheck default permissions for moderators group - they should have access admin dashboard

Thanks