User set as editor, can edit the editor type permissions!!!
I'm struggling to get my head around the sercurity model in the users area.
If I create a user as an editor, when they log in the default is that they can still access the user area, and change the permissions on the editor user type, and alter there own user type..
What have you chosen to give them access to under "sections"? If all sections have been checked then it makes sense. Are you sure that the user has been saved as an editor and not an administrator?
This so that the client can add there own copywriters. (without having to have 2 logins)
But like I say a I'm seeing a user set as an editor and given access to the users area can amend there own permissions (to areas), and the permissions on the editor user type.
Shouldn't it be that only admin can amend usertype info and their own settings, but anyone else shouldn't be able to change their own settings or usertype permisions?
User set as editor, can edit the editor type permissions!!!
I'm struggling to get my head around the sercurity model in the users area.
If I create a user as an editor, when they log in the default is that they can still access the user area, and change the permissions on the editor user type, and alter there own user type..
Is this how it should be working?
(ps u4.5.2, iis7, server 2008, medium trust, .net 3.5)
Hi Mike
It depends...
What have you chosen to give them access to under "sections"? If all sections have been checked then it makes sense. Are you sure that the user has been saved as an editor and not an administrator?
/Jan
model I was going to use...
internal team - administrators
client - Editor + User Admin
clients copywriter - writer
This so that the client can add there own copywriters. (without having to have 2 logins)
But like I say a I'm seeing a user set as an editor and given access to the users area can amend there own permissions (to areas), and the permissions on the editor user type.
Shouldn't it be that only admin can amend usertype info and their own settings, but anyone else shouldn't be able to change their own settings or usertype permisions?
Mike
is working on a reply...