Support

    You are here:  
  1. Home
  2. Support
  3. Edit Restrictions - Front End
Toggle Submenu
  1. Forums
  2. Recent
  3. Categories
  4. Tags
  5. Users
  6. Badges
Support is currently Online
Add a reply View Replies (6)

Resolved Security bug when editing profil

  1. idefix38
    idefix38
  2. Bug Report
  3. Saturday, February 13 2016, 09:26 AM
Hello,

i'm using joomla 3.4.8, Easy profil version pro.

I found a bug when i edit my profil. I can edit à profil of another user ! :D
see image. I have found wath this bug arrived when the user (olivier) have multiple user group. (here user olivier have "Author" and "Manager" user group).
user thomas has only "author" group).
If i remove the "manager" group to Olivier all work fine.
Attachments (2)
easyp1.png easyp1.png
easyp2.png easyp2.png
Responses (6)
admin
admin Accepted Answer
Admin
Hi,
this is not a bug, this is a features, try to check permission of Manager ACL from Administration->Users->Options->Permission tab (see screenshot)
Attachments (1)
Schermata 2016-02-13 alle 10.17.40.png Schermata 2016-02-13 alle 10.17.40.png
  1. more than a month ago
  2. Bug Report
  3. # 1
idefix38
idefix38 Accepted Answer
Pro
Content Protected
  1. more than a month ago
  2. Bug Report
  3. # 2
admin
admin Accepted Answer
Admin
can you please post me full backend access? you can use the form below the reply in "Site Details" tab
  1. more than a month ago
  2. Bug Report
  3. # 3
idefix38
idefix38 Accepted Answer
Pro
See site detail
  1. more than a month ago
  2. Bug Report
  3. # 4
admin
admin Accepted Answer
Admin
Thanks,
found the problem, the component JoomSEF have stored this URL (see also screenshot)
users/profile/edit.html => index.php?option=com_users&layout=edit&user_id=2201&view=profile

so when some "Manager" go to users/profile/edit.html this component pass variable user_id=2201 and he see "Thomas" details. Normal user not have permission to edit others profile so he show only his details (user_id var is ignored).

Now I have changed URL into index.php?option=com_users&layout=edit&view=profile (removed user_id var), and now works ;)
Attachments (1)
Schermata 2016-02-13 alle 15.59.32.png Schermata 2016-02-13 alle 15.59.32.png
  1. more than a month ago
  2. Bug Report
  3. # 5
idefix38
idefix38 Accepted Answer
Pro
OK . Thanks
  1. more than a month ago
  2. Bug Report
  3. # 6
  • Page :
  • 1


There are no replies made for this post yet.
However, you are not allowed to reply to this post.

Request Support

Support is currently Online
Ask a Question
Official support hours:
Monday To Friday except Saturday and Sunday
From 09:30 To 17:00

Support Availability

Working days: Monday to Friday. The support staff is not available on weekends; in the most of cases tickets will not be answered during that time.

Reply time: Depending on the complexity of your support issue it's usually between a few minutes and 24 hours for paid members and about one week for free members. When we expect longer delays we will notify you.

Guidelines

Before you post: read the documentation and search the forums for an answer to your question.

When you post: include Site Details if you request a support (you can use the form below the reply in Site Details tab).

Auto Solved Question: If after a week the author of the post does not reply to a request by moderator, the question will be marked as resolved.

Language: only English

Search Users

Easy Profile® is not affiliated with or endorsed by Open Source Matters or the Joomla Project. Joomla is Free Software released under the GNU/GPL License.

We use a few cookies

Our site uses non fat, delicious cookies which help us improve your user experience. You can read more about it in our Legal page.