View Issue Details

IDProjectCategoryView StatusLast Update
0025709mantisbtbugtrackerpublic2019-04-22 03:07
Reporter123 Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0025709: Global and local user rights when creating new users.
Description

Reflecting on the refinement of the process of creating new users, I found a problem that also affects 0025682.

I noticed that when adding the “Invite button” button to the top panel, the access_has_global_level (config_get ('manage_user_threshold')) function checks the user's global access level, but does not take into account the local access level to the project. Because of what non-logical system behavior may occur.
For example, if the user has the global right to create users, but at the same time does not have such locally in the project. As a result, after creating the user, he will not be able to add him to the project to which he does not have the appropriate access rights.

Moreover, at the moment on the manage_user_edit_page.php page, in the manage_user_proj_add block, the list of unassigned projects is formed without taking into account user access (manage_user_threshold) to the project, although the binding process that is performed in manage_user_proj_add.php takes into account access rights to the project, which leads to the omission of this project without any indication of an error.
This behavior in itself confuses the process of creating new users, not to mention the presence of this button on the front edge of the interface.

What do you think about it?

TagsNo tags attached.

Activities

There are no notes attached to this issue.