xoops forums

pulapol

Just popping in
Posted on: 2010/1/1 11:16
pulapol
pulapol (Show more)
Just popping in
Posts: 55
Since: 2008/4/6 1
#1

Group Permission - XOOPS 2.4x

I have 3 XOOPS site

2 is 2.41 1 is 2.43


using php 5.3

Ok in XOOPS site i made a second admin group and also edit the moderator so they can have access to some settings and modules in admin panel ...

i registered two new user one for the second admin group and one for moderator..

i made sure that both only belong to one group

and i test login to both account they have permission for all modules and settings

i'm the only one super admin..suppose only me can access this modules as what i have set



does anyone else have this error ? i have this error in 2.41 and 2.43 which i just upgraded



i'm using the exm theme..change to default same error

sorry for poor english....

pulapol

Just popping in
Posted on: 2010/1/1 12:47
pulapol
pulapol (Show more)
Just popping in
Posts: 55
Since: 2008/4/6 1
#2

Re: Group Permission - XOOPS 2.4x

example as superadmin i disable the group page & xoopscare module for my second admin

login as second admin

1. default theme

in left side i can't see xoopscare listed
but when i go to module..i can see xoopscare and klik i can go to xoopscare admin

in group page i can enter eventhough i have disable it

2. exm theme

xoopscare is listred in front admin panel

group page i can enter

pulapol

Just popping in
Posted on: 2010/1/3 1:57
pulapol
pulapol (Show more)
Just popping in
Posts: 55
Since: 2008/4/6 1
#3

Re: Group Permission - XOOPS 2.4x

..i know what have caused the problem above


Initially XOOPS have 3 type of user


Webmaster
Regsitered User
Anonymous User


what i did in my 3 XOOPS site was to create a custom new group and make it a super admin - all access

and the original webmaster account i edited the permission to be a 2nd admin - limited access

so when i access an account with the group of webmaster.....(which suppose to be super admin) i still had access to
modules i set the restriction




after i change back the webmaster to be super admin all accesss

and the custom group to limited access (2nd admin)


Now its all Ok

i don't if this a bug or not

maybe someone can change the topic from group permission in XOOPS 2.4 to

editing webmaster group causing permission problem

ghia

Community Support Member
Posted on: 2010/1/3 2:37
ghia
ghia (Show more)
Community Support Member
Posts: 4954
Since: 2008/7/3 1
#4

Re: Group Permission - XOOPS 2.4x

If a user belongs to more than 1 group, the permissions are cumulative.
So, when the webmasters group is denied, but the superadmin is allowed, you are still granted, if you belong to both groups.
Beware, some modules grant extra rights to the user with uid 1.

pulapol

Just popping in
Posted on: 2010/1/3 3:26
pulapol
pulapol (Show more)
Just popping in
Posts: 55
Since: 2008/4/6 1
#5

Re: Group Permission - XOOPS 2.4x

i made the user belong to only one group that is superadmin (custom group)

and yet i have the problem in post # 1

ghia

Community Support Member
Posted on: 2010/1/3 9:16
ghia
ghia (Show more)
Community Support Member
Posts: 4954
Since: 2008/7/3 1
#6

Re: Group Permission - XOOPS 2.4x

Does such a user (only belonging to 1 moderator user group, with admin rights to 1 module) have unwanted admin access to all other installed modules or just to a few?
Can you list their names and version numbers with the status of allowed, unwanted granted or denied?

pulapol

Just popping in
Posted on: 2010/1/3 12:36
pulapol
pulapol (Show more)
Just popping in
Posts: 55
Since: 2008/4/6 1
#7

Re: Group Permission - XOOPS 2.4x

Yes Ghia..so far i have test fews modules and same problem...



for those of you want to test this bug do it like this

1. create a custom group called superadmin...give all access/admin rights

2. Edit the original webmaster group..disable some admin access to system settings

as example group , comment

disable access admin right also to modules

as example xoopspoll & xoopscare


3. create two users, or edit an existing user

- first user make him/her to belong only in one group that is webmaster
- and the 2nd only superadmin (the custom group)
- make sure both user belong to only one group


4. clear cache..history etc

5. Login as the first user (webmaster)

try access the group and comment setting in admin panel....and also XOOPS care and XOOPS poll try do some action as example create new poll, create edit comment etc
you can access it despite you had restricted it earlier...

<<<<<< BUG

6. Login as 2nd user (superadmin)

- all access as expected

ghia

Community Support Member
Posted on: 2010/1/3 13:53
ghia
ghia (Show more)
Community Support Member
Posts: 4954
Since: 2008/7/3 1
#8

Re: Group Permission - XOOPS 2.4x

And if you leave all rights in the webmasters group and only the limited rights in the other group, I assume there is no problem?

Version and status of the modules?

pulapol

Just popping in
Posted on: 2010/1/3 14:09
pulapol
pulapol (Show more)
Just popping in
Posts: 55
Since: 2008/4/6 1
#9

Re: Group Permission - XOOPS 2.4x

Quote:
And if you leave all rights in the webmasters group and only the limited rights in the other group, I assume there is no problem?


yes

i'm using XOOPS 2.41 & XOOPS 2.43

its not module specific..you can try it

trabis

Core Developer
Posted on: 2010/1/3 14:22
trabis
trabis (Show more)
Core Developer
Posts: 2268
Since: 2006/9/1 1
#10

Re: Group Permission - XOOPS 2.4x

In mainfile you should have
define('XOOPS_GROUP_ADMIN', '1');

Try to replace 1 by the new super admin groupid and tell me if it works.