search

modmore / ClientConfig

ClientConfig is a MODX Revolution Extra to allow clients to maintain settings in a user friendly way.
https://docs.modmore.com/en/Open_Source/ClientConfig/index.html
MIT License
28 stars 27 forks source link

Content managers has ability to edit global site ClientConfig settings #185

Open NDruce opened 3 years ago

NDruce commented 3 years ago

Content managers has access to change values in ClientConfig, so they can, administer the site in some way. For example, access to global MODX settings is restrictable, so there is logic that ClientConfig has to be restrictable too. Please, fix access control to ClientConfig, because it can contain sensitive data that some roles of users must be denied to modify anyway and even see too.

Mark-H commented 3 years ago

There's #17 and #88 which request more granular permissions but I'm interested in your use case where CC contains settings that are considered sensitive.