Roles get removed when somebody without permission edits another role

[DOJ Liam]

Hi,

In our community we have different groups of people set up to be able to edit groups via the Admin CP (as expected). It has been noticed for a while that even when somebody with permission to give a certain tag does so, if the person they're editing has a role that they can't assign it will remove it. I.e. An Admin edits another Admin to add a role that they both can add, it will remove their Admin role... it appears that the software basically removes all the roles and then re-assigns with the edits.

 

Is this intended behaviour or is this a bug that's gone un-noticed?? Just a bit of a pain as myself and my team as website management are the only ones who can fix this if this happens.

[Jim M]

Our system does not have restrictions on adding specific member groups to a user. Reversely, an administrator cannot modify their own group permissions but that does not sound like what you're stating here. Is this something custom which you have a third party addon for?

[DOJ Liam]

I've just tested with one of our Administration staff against my test account which had the same Administrator role. As soon as the person went to edit my roles, it picked the next available. The only thing I can imagine this is something to do with not having the 'Can move admins into other groups' option not selected under the Administration Staff role in Administrators?

 

Only issue with having this enabled is that surely then any other Administration staff can give out the Administration Staff (and unrestricted Web Developer role...)? If I'm wrong, let me know on this...

We do have a third-party addon to allow for our Staff members to adjust certain groups via the ModeratorCP but this is happening in the AdminCP as well as the AdminCP. Looks like it's mimicking the behaviour built in to IPS on how to manage roles..? Another example using this plugin was that a Staff member adjusted another Staff member's secondary groups and it removed a group that was also set as Moderator.

[Marc Stridgen]

You would have to speak to the author of that addon. As its happening only when someone is not able to move to a specific group, and that functionality is provided by a 3rd party application, this is not something in which we would be able to advise on

[DOJ Liam]

Sorry for the response delay - this is not just the addon. This is happening in AdminCP too...

Scenario:

Admin 1 needs to add a secondary group to Admin 2

When Admin 1 goes into AdminCP and edits Admin 2's groups, the list only shows what they have access to, defaulting their primary group to the next available

 

We've tried enabling the Admins being allowed to add to admin groups but this gives them a lot more power than we are willing to give (i.e. root admin w/ unrestricted perms, web developer, etc...)

[Jim M]

If the administrator does not have access to assign other groups to an administrator, that would be correct. They should only be able to assign the administrator group which they are assigned or not be able to access. 

You're currently on an outdated release of our software so first, I would advise upgrading if you're seeing otherwise.