Support

    You are here:  
  1. Home
  2. Support
  3. spaceghana
Toggle Submenu
  1. Forums
  2. Recent
  3. Categories
  4. Tags
  5. Users
  6. Badges
Support is currently Offline
Support Offday
Today is our off day. We are taking some rest and will come back stronger tomorrow. Promise!
Official support hours:
Monday To Friday except Saturday and Sunday
From 09:30 To 17:00
Our current time: Sunday 2:32 am
Add a reply View Replies (6)

Resolved Security bug when editing profil

  1. idefix38
    idefix38
  2. Bug Report
  3. Saturday, February 13 2016, 09:26 AM
Hello,

i'm using joomla 3.4.8, Easy profil version pro.

I found a bug when i edit my profil. I can edit à profil of another user ! :D
see image. I have found wath this bug arrived when the user (olivier) have multiple user group. (here user olivier have "Author" and "Manager" user group).
user thomas has only "author" group).
If i remove the "manager" group to Olivier all work fine.
Attachments (2)
easyp1.png easyp1.png
easyp2.png easyp2.png
Responses (6)
admin
admin Accepted Answer
Admin
Hi,
this is not a bug, this is a features, try to check permission of Manager ACL from Administration->Users->Options->Permission tab (see screenshot)
Attachments (1)
Schermata 2016-02-13 alle 10.17.40.png Schermata 2016-02-13 alle 10.17.40.png
  1. more than a month ago
  2. Bug Report
  3. # 1
idefix38
idefix38 Accepted Answer
Pro
Content Protected
  1. more than a month ago
  2. Bug Report
  3. # 2
admin
admin Accepted Answer
Admin
can you please post me full backend access? you can use the form below the reply in "Site Details" tab
  1. more than a month ago
  2. Bug Report
  3. # 3
idefix38
idefix38 Accepted Answer
Pro
See site detail
  1. more than a month ago
  2. Bug Report
  3. # 4
admin
admin Accepted Answer
Admin
Thanks,
found the problem, the component JoomSEF have stored this URL (see also screenshot)
users/profile/edit.html => index.php?option=com_users&layout=edit&user_id=2201&view=profile

so when some "Manager" go to users/profile/edit.html this component pass variable user_id=2201 and he see "Thomas" details. Normal user not have permission to edit others profile so he show only his details (user_id var is ignored).

Now I have changed URL into index.php?option=com_users&layout=edit&view=profile (removed user_id var), and now works ;)
Attachments (1)
Schermata 2016-02-13 alle 15.59.32.png Schermata 2016-02-13 alle 15.59.32.png
  1. more than a month ago
  2. Bug Report
  3. # 5
idefix38
idefix38 Accepted Answer
Pro
OK . Thanks
  1. more than a month ago
  2. Bug Report
  3. # 6
  • Page :
  • 1


There are no replies made for this post yet.
However, you are not allowed to reply to this post.

Request Support

Support is currently Offline
Ask a Question
Official support hours:
Monday To Friday except Saturday and Sunday
From 09:30 To 17:00

Support Availability

Working days: Monday to Friday. The support staff is not available on weekends; in the most of cases tickets will not be answered during that time.

Reply time: Depending on the complexity of your support issue it's usually between a few minutes and 24 hours for paid members and about one week for free members. When we expect longer delays we will notify you.

Guidelines

Before you post: read the documentation and search the forums for an answer to your question.

When you post: include Site Details if you request a support (you can use the form below the reply in Site Details tab).

Auto Solved Question: If after a week the author of the post does not reply to a request by moderator, the question will be marked as resolved.

Language: only English

Search Users

Easy Profile® is not affiliated with or endorsed by Open Source Matters or the Joomla Project. Joomla is Free Software released under the GNU/GPL License.

We use a few cookies

Our site uses non fat, delicious cookies which help us improve your user experience. You can read more about it in our Legal page.