search

wid-tech / website

1 stars 0 forks source link

Admin Plan and No Plan must be differentiated in Main members screen #70

Closed pamelatech closed 3 years ago

pamelatech commented 3 years ago

Describe the bug When you list all the users in the main members screen, admins show up as having no plan. This makes it hard to figure out if there are actually users who accidentally have no plan. This is a security issue, because this messy list habituates users to see both privileged and unprivileged users in this category. an attacker who could get themselves added to the admin plan could pass unnoticed as a result when other admins scan this list.

What kind of user are you? Site Admin

To Reproduce Steps to reproduce the behavior:

  1. Go to https://www.womeninidentity.org/onepage/members
  2. Sort by plan
  3. Pick a user with a blank entry for a plan
  4. Are they admins? Are they misformed new users? We can't tell :(

Expected behavior If a user has the admin plan, the list should say "Admin". If you user has no plan, the list should ideally say "No plan".

Screenshots image

mcresilkstart commented 3 years ago

@pamelatech admins don't need to be assigned to a plan as the Admin status determines their access rights. However most admin usually do get assigned to a plan and I would recommend that you adopt that approach. Note that you can filter the member list by various nested criteria including by plan and by admin Yes/No status.

hlflanagan commented 3 years ago

Will do. Thanks for the feedback!