search

octobercms / october

Self-hosted CMS platform based on the Laravel PHP Framework.
https://octobercms.com/
Other
11.03k stars 2.21k forks source link

Administrator permissions leaks #729

Closed BMCouto closed 10 years ago

BMCouto commented 10 years ago

Hi,

When creating an administrator with specific permissions, it's not possible to control the following:

Also, I've customised the logo (.png if it matters) but it doesn't show up on any location on the backend, why?

October is turning great, but it's urgent to improve the backend for client's usage. Thank you!

KB1RMA commented 10 years ago

+1 for attention to the backend. I'm really running into a lot of little gripes lately that make it very difficult to deploy.

BMCouto commented 10 years ago

@daftspunk any news on this? Thanks!

BMCouto commented 10 years ago

Really need a solution to this so I can deliver the backend to the client. @daftspunk any estimative for implementing this?

daftspunk commented 10 years ago

Users can see/edit "Components" if they permission to edit pages, layouts or partials

Widgets are contextual to the user, so if they have access to the dash, they need the ability to customize their own dash.

Available updates are now hidden from the Dash if permissions are not found.

Not sure what the other references mean, missing detail.

BMCouto commented 10 years ago

@daftspunk yes widgets are contextual to the user, but as an administrator I should be able to create a user that can't see widgets. For example, with the Analytics plugins installed, I don't have a way to create a user that can't see my analytics information. I see that as a bug, do you agree?

Also, I have my account set to english, but let's say my client speaks german, I can't create an account with a language set, so I want to keep my user account in english and provide the backend to the client in german. Also a bug / feature to implement, agree?

Finally, and because the translation plugin is one of the most important plugins to let clients change their content, it should be possible to give permission to the user to see the translation plugin but not the entire backend configs that are available on the same menu of "Messages" and "Languages". Should be more modular, and let me say "allow user to see translations plugin" when creating a new account. The same goes to other plugins, for example, I want the client to access the Static Pages Plugin, but not the CMS area. Basically, I want to give the client permission to edit only certain pages of the website and right now it's not possible, which is bringing me huge problems, since I have the entire project ready to launch on october cms and it's a huge project... I did a bad evaluation, I should have seen that it wasn't possible on October, but I'm praying that you can implement this important features and fix this permissions bugs in time. Can you?

Thanks!