[#15217] - Administrator cannot access assigned usergroup tab on his own account
- Closed
- 18 Aug 2017
- Medium
- Build: 3.6.5
- # 15217
Steps to reproduce the issue
Login to a joomla website with an administrator account.
Navigate to users > manage and select the account you have logged in with.
Expected result
Administrator user should be able to see "Assigned User Groups" Tab and join any group (except the ones that are over him (such as super user).
Actual result
Administrator user is unable to view "Assigned User Groups" Tab.
Weird is that if he edit another user, he is able to see Assigned User Groups and change what he wants.
System information (as much as possible)
Joomla 3.6.5
PHP Version ( 5.6.30 ).
Tested on multiple websites.
Additional comments
Votes
joomla-cms-bot
- 
The logic is wrong and i point why.
The admin can make other users and give access to whatever group he want to. And that action checks if the user has user groups over him and dont gives him access to those.
Also its something that on Joomla 2x was a working thing.
This is a bug and i dont know for how long ...!
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15217.
If I remember right it was done as part of a security issue (elevating permissions).
@SniperSister Can you check this with JSST?
So... why do we let him make another user and give whatever access he wants to?
I think that a user should be able to join another group if this user has rights to use the user control system and this group is under him...
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15217.
That's the thing! There is no simple "under him" in the current user group setup, because the subgroups don't necessearly need to have more privileges than the parent group.
franz-wohlkoenig
- | Priority | Urgent | ⇒ | Medium |
| Status | New | ⇒ | Discussion |
Closing as expected behaviour even if it is not desirable
| Status | Discussion | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-08-18 20:33:33 |
| Closed_By | ⇒ | brianteeman |
You can't do that because you don't know which groups are "higher". The hierarchy you see in the groups doesn't necessary mean the same hierarchy applies for ACL. "Higher" groups may have actions denied that lesser groups can do.
So the only way to prevent a user from elevating his own permissions is to restrict the access to his own permission related things.
I'd say this is intended behavior.