MantisBT: master 25223c9e

Diff Back to Repository
Author Committer Branch Timestamp Parent
dhx dhx master 2010-03-31 09:17 master fbfdfe40
Affected Issues  0011530: Support multiple access levels above manage_user_threshold
Changeset

Fix 0011530: Support multiple access levels above manage_user_threshold

Traditionally manage_user_threshold was thought of as being an absolute
global threshold which would allow any user the ability to modify any
other user account. Thus manage_user_threshold effectively had to be the
same as admin_site_threshold because users with manage_user_threshold
could just modify accounts to escalate their permissions to the maximum
level.

This patch prevents users from modifying accounts which have an access
level greater than their own. It also prevents users from creating
accounts with with access levels greater than their own.

Thus it is now possible to use manage_user_threshold as a separate
permission level to admin_site_threshold. Users with an access level
between manage_user_threshold <= user access level <
admin_site_threshold can no longer escalate their permissions or modify
the accounts of other users with a higher access level.
mod - manage_proj_user_remove.php Diff File
mod - manage_proj_user_copy.php Diff File
mod - manage_user_prune.php Diff File
mod - core/project_api.php Diff File
mod - manage_user_edit_page.php Diff File
mod - manage_user_proj_add.php Diff File
mod - manage_user_proj_delete.php Diff File
mod - manage_user_delete.php Diff File
mod - manage_user_update.php Diff File
mod - account_prefs_reset.php Diff File
mod - account_prefs_update.php Diff File
mod - manage_user_page.php Diff File
mod - manage_proj_edit_page.php Diff File
mod - manage_user_create.php Diff File
mod - manage_user_reset.php Diff File
mod - manage_user_create_page.php Diff File