User can change his own role in panel when changeRole is turned off

[kaloja]

I think this is a critical bug for the user roles system. The user can change his own role in panel from “Your account” even when changeRole: false is set in the user blueprint.

My blueprint:

title: Reviewer
permissions:
  access:
    panel: true
    users: false
    site: true
  site:
    update: false
  users: false

I also tested this:

title: Reviewer
permissions:
  access:
    panel: true
    users: false
    site: true
  site:
    update: false
  users:
    create: false
    createAvatar: false
    deleteAvatar: false
    changeName: false
    changeEmail: false
    changePassword: false
    changeRole: false
    delete: false
    update: false

[jimbobrjames]

Could you post the whole blueprint please?

[kaloja]

Yes, updated my post. See above.

[jimbobrjames]

Yes, I think you are right. I’m getting some issues too. With your blue print in place, I can still change the role when logged in as a Reviewer. If I log into the reviewer account and log out again, this happens…

Looking at your blueprint against the documentation I cant see any issues with it. I’m sure one of the support team will see this shortly.

Edit: The role setting seems to work if you log out, clear the cache and log in again. You shouldnt have to do that though, I dont think.

[texnixe]

As an admin, I created a new user with the reviewer role. Then logged in as this reviewer.

Result: The reviewer cannot access the user section with this setting at all with the first blueprint.

[kaloja]

@texnixe The bug is when you click on “Your account” and then on the role.

[jimbobrjames]

@texnixe

The reviewer cannot access the user section with this setting at all with the first blueprint.

Yes that worked for me too, its the second blue print that seems to have issues.

[kaloja]

Screenshots taken with this blueprint:

title: Redaktör

fields:
  name:
    label: Namn
    type: text

permissions:
  access:
    panel: true
    users: false
    site: true
  site:
    update: false
  pages:
    delete: false
  users: false

1. Click your account
   

   

2. Click on the role line
   

3. Popup modal with option to change your role
   

   

[texnixe]

I think the problem is that you use the wrong setting. There is a users setting and a user setting and to deny access to a single user or to restrict what the user can do, you need the user setting.

[jimbobrjames]

@texnixe

There is a users setting and a user setting

That isn’t detailed in the docs, only settings for users is.

[texnixe]

User blueprint

But yes, in the guide, that seems to be an error.

The blueprint should look like this:

title: Reviewer
permissions:
  access:
    panel: true
    users: false
    site: true
  site:
    update: false
  user:
    changeRole: false

I.e. with access > users > false, and then just the single user settings.

[texnixe]

I created an issue to fix this.

[kaloja]

That works. Superb help @texnixe

[texnixe]

@kaloja Sorry for the trouble caused by incorrect documentation.

[sennah]

Just to add this: In the docs, “user blueprint permissions” seem to be a bit inconsistent between the guide (usres > permissions) and the reference (panel > blueprints > user blueprint). Some options are missing in the reference; and “access > settings” seems not to be documented at all.