Uploaded image for project: 'phpBB'
  1. phpBB
  2. PHPBB-17668

Hardening: Prevent managing special groups from UCP

XMLWordPrintable

    • Icon: Improvement Improvement
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 3.3.17
    • None

      It's currently possible to manage special groups from the UCP if you are the group leader. If someone is set as the leader of the administrators group, this feature allows to add additional admins without access to the ACP.

       

      It's currently already not possible to edit group descriptions for special groups via the UCP. To keep things simple we should also add this limitation to the UCP group management for special groups. Special groups will have to be managed from the ACP requiring an additional security check.

       

      The side effect of this change will be that leader of the Global Moderators group will no longer be able to add or remove team members via the UCP. This could be solved by creating a different moderator group.

            Unassigned Unassigned
            Derky Derky
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: