Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Panel] Only admin should be able to create admin users #1843

Closed
texnixe opened this issue Jun 8, 2019 · 1 comment

Comments

3 participants
@texnixe
Copy link

commented Jun 8, 2019

Describe the bug
Currently, when creating new users, there is no way to limit the roles a user with permissions to create other users can assign (at least I'm not aware of it). But this looks like a security issue to me, because non-admin users with a right to create new admin users can thus effectively make themselves admins by logging in as this newly created user.

To Reproduce
Steps to reproduce the behavior:

  1. Create a new user role, e.g. Editor with permissions to create users
  2. Create a new user with the Editor role
  3. Log in as this editor user
  4. Create a new user
  5. See how this editor can create a user with any user role including admin users.

Expected behavior
A user with a given role should not be able to create admin users (and in fact it should be possible to define a set of roles this user can assign to a new user, see getkirby/ideas#316

Screenshots
If applicable, add screenshots to help explain your problem.

Kirby Version
3.2.0rc2

@bastianallgeier

This comment has been minimized.

Copy link
Contributor

commented Jul 1, 2019

bastianallgeier added a commit that referenced this issue Jul 1, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.