Project

General

Profile

Actions
Copy link

Bug #778

closed

All logged in users can still access various administrator pages by typing in its complete url

Added by Anchi Cheng over 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Amber Herold
Category:
-
Target version:
Appion - Appion/Leginon 2.1.0
Start date:
07/26/2010
Due date:
% Done:

100%

Estimated time:
Affected Version:
Appion/Leginon 2.0.2
Show in known bugs:
No
Workaround:

Description

Need to redirect if no privilege to view it and remove editing ability if not administrator

Actions
Copy link
 #1

Updated by Anchi Cheng over 14 years ago

  • Status changed from Assigned to In Code Review
  • Assignee changed from Anchi Cheng to Eric Hou
  • Priority changed from High to Normal
  • % Done changed from 0 to 100

fix with r14557. Because groups, instruments, applications editing affects all users. They require level 4 privilege in "groups" to edit. I also did it in the same way for adduser.php because even power user should not change someone else's user profiles. I have taken care of these in revertsettings.php before.

goniometer.php which also found in admin.php side-bar is a view-only page so it just need to check if the user is logged in.

might be possible to move is_logged into admin.inc now that all of them need to do it.

Actions
Copy link
 #2

Updated by Eric Hou over 14 years ago

  • Status changed from In Code Review to In Test
Actions
Copy link
 #3

Updated by Eric Hou over 14 years ago

  • Assignee changed from Eric Hou to Amber Herold
Actions
Copy link
 #4

Updated by Amber Herold over 14 years ago

  • Assignee changed from Amber Herold to Anchi Cheng

http://fly/myamiweb/user.php allows anonymous user to view (but not edit) all users. Do we want people who don't even have a login to have access to all of our users names, emails, addresses, and phone numbers?

Actions
Copy link
 #5

Updated by Anchi Cheng over 14 years ago

  • Assignee changed from Anchi Cheng to Amber Herold

Did more refinement on page access in r14701, including remove access to users.php page to guest group to which anonymous user belongs. Currently,

Administration group: view and edit everything.

Power user: deny addusers.php. addinstrument.php, addapps.php, deny editing on users.php, deny revertsettings.php on users other than him/herself.

User group: also deny access on users.php in addition to restriction on Power user.

Guest group: also deny access on revertsettings.php, goniometer.php

Actions
Copy link
 #6

Updated by Amber Herold about 14 years ago

looks good

Actions
Copy link
 #7

Updated by Amber Herold about 14 years ago

  • Status changed from In Test to Closed
Actions
Copy link

Also available in: Atom PDF