Dependency Graph
View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006251 | mantisbt | administration | public | 2005-09-15 13:41 | 2008-08-12 09:17 |
| Reporter | jkring | Assigned To | grangeway | ||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | closed | Resolution | no change required | ||
| Product Version | 1.0.0rc2 | ||||
| Summary | 0006251: project administrators cannot access Manage page if not a global administrator | ||||
| Description | Project administrators are allowed access to the "Manage Projects" page, where they will see a listing of the projects for which they are administrators. However, if they are not a global administrators, they cannot access the "Manage" page ("permission denied" message). And, the "Manage" page is the only one with a link to the "Manage Projects" page. So, project administrators have no way to easily get to the "Manage Projects" page. The only way they can get to the "Manage Projects" page is if they know the URL (<mantis_site>/manage_proj_page.php). | ||||
| Tags | No tags attached. | ||||
|
Looking at the code (html_api.php): 500 # Manage Users (admins) or Manage Project (managers) or Manage Custom Fields I was able to quick-fix the problem by changing... 506 $t_link = 'manage_user_page.php'; to... 506 $t_link = 'manage_proj_edit_page.php'; However, I'm not sure if this is the right way to fix the problem. The question is this: Should project administrators who are not global administrators have access to Manage Users (manage_user_page.php)? If yes, then there is a problem with manage_user_page.php. If no, then the fix above seems to be the best solution. |
|
|
Actually, if project admins are not supposed to access the user administration screen, then it might be better to change... 503 if ( access_has_global_level( $t_show_access) || access_has_any_project( $t_show_access ) ) { ...to... 503 if ( access_has_global_level( $t_show_access) ) { ...so that global admins will still access the manage users page, first. |
|
|
I tried both of these suggested solutions without success (the first one gave me an Application Error about a missing argument, and the second one just removed the Manage link altogether.) I then realized that the first issue was missing the project id link. Thus, changing line 506 to be $t_link = 'manage_proj_edit_page.php?project_id=' . $t_current_project; seemed to work fine. However, there now was an issue with the global administrator; if you clicked on the Manage link from "All Projects", it would take you to the edit page for Project 0, which really doesn't exist. As a final solution, I ended up changing the entire if function to read: if ( access_has_global_level( $t_show_access) || access_has_any_project( $t_show_access ) ) { That redirects every Manage link to the Manage Project page, where users can choose which project they want to manage. This isn't necessarily the best solution, but it works for our admins (and they like it better than getting the permission denied error.) |
|
|
I think this is a duplicate of 0006019. Can you confirm this is the case, and that project administrators can go to manage page if "All project" is selected? |
|
|
Thank you for taking the time to report a problem with mantis. Since this problem report was originally made, a number of releases have occured. Additionally no recent feedback has been received on this issue. Unfortunately you are not using the latest version and the problem might already be fixed. Please download the latest release from http://www.mantisbt.org/download.php [^] [^] If you are able to reproduce this bug in the current release, or have some more information on how this feature could be improved in the current release. Please either change the mantis version on this bug report Again, thank you for your continued support and report. |
|
related to
child of
duplicate of