ACP Restrictions.

[uratoh]

So, I was just playing with the ACP Restrictions, and I found something.

When a person who has only limited access to the ACP moves another member into any Admin group, the person they moved has full ACP access without any restrictions. Surely that's just an oversight?

It'd be nice if anybody the restricted user moves into the Admin group inherits their permissions, like when adding a new member directly to the group. See what I'm saying?

[Ziv Grosu]

When you moves into the admin group inherits thier permission they have the same functions. because you moved them to "admin root" group. Check it again in your Board. I think that's not bug.

Go to your ACP and then you will see the menu ,choose an: Management ,and then you will see the first cat. ,looking for : Permission Mask and then you will see the settings of the members, If It didn't work. please explain your problem again. :]

[uratoh]

No, I didn't. I'm 100% positive I didn't move them into the Root group.

[Ziv Grosu]

please explain you problem again. (If you can do it).

[Mark]

Hmmm.... I suppose it would be intended, but something should be done - try reporting it as a bug.

For now, just don't give restricted admins permission to edit members

[uratoh]

EDIT: k, I'll report it on the bug tracker. o.o

Alright.

As an example, let's say I'm Jim. I have a fellow Administrator, Bob, who only has access to the Management Tab in the ACP. Bob decides that he wants to go and move Jane into an Administrator group. Jane now has full access to the Admin CP, because Bob moved Jane into an Admin group. Bob still only has access to the Management Tab, because I don't want anybody but me, Jim, to have anything else. Bob can give full ACP access to anybody, while only having partial access like he's supposed to.

[Ziv Grosu]

Bob became to be a root administrator??? or Jane? First there was Jane with a full permission ,yea?

[Working4computers]

There is no mention of root administrator.

Nobody can make themself root, only members of the root admin group can add to that group. (This was a bug in 2.0)

A administrator who only has partial access to the ACP, (management tab for example), added another user to the administrators group. The user who was given administrators status, has full ACP power, no resistrictions.

[stobbo]

This should be changed in my opinion. Nothing to stop someone creating another account, then making it admin to damage the board.