Relationship Graph

Relationship Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

IDProjectCategoryView StatusLast Update
0006251mantisbtadministrationpublic2008-08-12 09:17
Reporterjkring Assigned Tograngeway  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionno change required 
Product Version1.0.0rc2 
Summary0006251: project administrators cannot access Manage page if not a global administrator
Description

Project administrators are allowed access to the "Manage Projects" page, where they will see a listing of the projects for which they are administrators. However, if they are not a global administrators, they cannot access the "Manage" page ("permission denied" message). And, the "Manage" page is the only one with a link to the "Manage Projects" page. So, project administrators have no way to easily get to the "Manage Projects" page. The only way they can get to the "Manage Projects" page is if they know the URL (<mantis_site>/manage_proj_page.php).

TagsNo tags attached.

Relationships

has duplicate 0006019 closedatrol Project admin can't get access to manage project 

Activities

jkring

jkring

2005-09-15 14:18

reporter   ~0011375

Looking at the code (html_api.php):

500 # Manage Users (admins) or Manage Project (managers) or Manage Custom Fields
501 $t_show_access = min( config_get( 'manage_project_threshold' ), config_get( 502 'manage_custom_fields_threshold' ), ADMINISTRATOR );
503 if ( access_has_global_level( $t_show_access) || access_has_any_project( $t_show_access ) ) {
504 $t_current_project = helper_get_current_project();
505 if ( access_has_project_level( ADMINISTRATOR, $t_current_project ) ) {
506 $t_link = 'manage_user_page.php';
507 } else {
508 if ( access_has_project_level( config_get( 'manage_project_threshold' ), $t_current_project )
509 && ( $t_current_project <> ALL_PROJECTS ) ) {
510 $t_link = 'manage_proj_edit_page.php?project_id=' . $t_current_project;
511 } else {
512 $t_link = 'manage_proj_page.php';
513 }
514 }
515 $t_menu_options[] = "<a href=\"$t_link\">" . lang_get( 'manage_link' ) . '</a>';
516 }

I was able to quick-fix the problem by changing...

506 $t_link = 'manage_user_page.php';

to...

506 $t_link = 'manage_proj_edit_page.php';

However, I'm not sure if this is the right way to fix the problem. The question is this:

Should project administrators who are not global administrators have access to Manage Users (manage_user_page.php)? If yes, then there is a problem with manage_user_page.php. If no, then the fix above seems to be the best solution.

jkring

jkring

2005-09-15 15:16

reporter   ~0011376

Actually, if project admins are not supposed to access the user administration screen, then it might be better to change...

503 if ( access_has_global_level( $t_show_access) || access_has_any_project( $t_show_access ) ) {

...to...

503 if ( access_has_global_level( $t_show_access) ) {

...so that global admins will still access the manage users page, first.

radams

radams

2006-07-27 11:31

reporter   ~0013161

I tried both of these suggested solutions without success (the first one gave me an Application Error about a missing argument, and the second one just removed the Manage link altogether.)

I then realized that the first issue was missing the project id link. Thus, changing line 506 to be

$t_link = 'manage_proj_edit_page.php?project_id=' . $t_current_project;

seemed to work fine. However, there now was an issue with the global administrator; if you clicked on the Manage link from "All Projects", it would take you to the edit page for Project 0, which really doesn't exist.

As a final solution, I ended up changing the entire if function to read:

if ( access_has_global_level( $t_show_access) || access_has_any_project( $t_show_access ) ) {
$t_link = 'manage_proj_page.php';
$t_menu_options[] = "<a href=\"$t_link\">" . lang_get( 'manage_link' ) . '</a>';
}

That redirects every Manage link to the Manage Project page, where users can choose which project they want to manage. This isn't necessarily the best solution, but it works for our admins (and they like it better than getting the permission denied error.)

giallu

giallu

2008-01-22 17:43

reporter   ~0016764

I think this is a duplicate of 0006019.

Can you confirm this is the case, and that project administrators can go to manage page if "All project" is selected?

grangeway

grangeway

2008-07-28 16:21

reporter   ~0018871

Thank you for taking the time to report a problem with mantis.

Since this problem report was originally made, a number of releases have occured. Additionally no recent feedback has been received on this issue.
It appears that this issue has either been fixed, or may not be a relevant report for the current release.

Unfortunately you are not using the latest version and the problem might already be fixed. Please download the latest release from http://www.mantisbt.org/download.php [^] [^]

If you are able to reproduce this bug in the current release, or have some more information on how this feature could be improved in the current release. Please either change the mantis version on this bug report
to the version you tested and change the status back to "Open", or open a new issue report with more information.

Again, thank you for your continued support and report.