Toggle Submenu
  1. Forums
  2. Recent
  3. Categories
  4. Tags
  5. Users
  6. Badges
Support is currently Offline
Support Offline
It's past support hour. We are taking some rest and will come back stronger tomorrow. Promise!
Official support hours:
Monday To Friday except Saturday and Sunday
From 09:30 To 17:00
Our current time: Wednesday 10:19 pm
Add a reply View Replies (6)

Resolved Security bug when editing profil

  1. idefix38
    idefix38
  2. Bug Report
  3. Saturday, February 13 2016, 09:26 AM
Hello,

i'm using joomla 3.4.8, Easy profil version pro.

I found a bug when i edit my profil. I can edit à profil of another user ! :D
see image. I have found wath this bug arrived when the user (olivier) have multiple user group. (here user olivier have "Author" and "Manager" user group).
user thomas has only "author" group).
If i remove the "manager" group to Olivier all work fine.
Attachments (2)
easyp1.png easyp1.png
easyp2.png easyp2.png
Responses (6)
admin
admin Accepted Answer
Admin
Hi,
this is not a bug, this is a features, try to check permission of Manager ACL from Administration->Users->Options->Permission tab (see screenshot)
Attachments (1)
Schermata 2016-02-13 alle 10.17.40.png Schermata 2016-02-13 alle 10.17.40.png
  1. more than a month ago
  2. Bug Report
  3. # 1
idefix38
idefix38 Accepted Answer
Pro
Content Protected
  1. more than a month ago
  2. Bug Report
  3. # 2
admin
admin Accepted Answer
Admin
can you please post me full backend access? you can use the form below the reply in "Site Details" tab
  1. more than a month ago
  2. Bug Report
  3. # 3
idefix38
idefix38 Accepted Answer
Pro
See site detail
  1. more than a month ago
  2. Bug Report
  3. # 4
admin
admin Accepted Answer
Admin
Thanks,
found the problem, the component JoomSEF have stored this URL (see also screenshot)
users/profile/edit.html => index.php?option=com_users&layout=edit&user_id=2201&view=profile

so when some "Manager" go to users/profile/edit.html this component pass variable user_id=2201 and he see "Thomas" details. Normal user not have permission to edit others profile so he show only his details (user_id var is ignored).

Now I have changed URL into index.php?option=com_users&layout=edit&view=profile (removed user_id var), and now works ;)
Attachments (1)
Schermata 2016-02-13 alle 15.59.32.png Schermata 2016-02-13 alle 15.59.32.png
  1. more than a month ago
  2. Bug Report
  3. # 5
idefix38
idefix38 Accepted Answer
Pro
OK . Thanks
  1. more than a month ago
  2. Bug Report
  3. # 6
  • Page :
  • 1


There are no replies made for this post yet.
However, you are not allowed to reply to this post.