[#22236] - [3.9] Module Action Logs - Latest exposing info to non superusers
- Closed
- 18 Sep 2018
- Medium
- Build: 3.9
- # 22236
Steps to reproduce the issue
login to the back-end with a user with manager (or administrator) rights
Expected result
module Action Logs - Latest should NOT display log entries
Actual result
module Action Logs - Latest displays log entries
and manager / administrator can even see more log entries by changing the value in the module
System information (as much as possible)
Joomla! 3.9.0-beta Beta [ Amani ] 11-September-2018 12:15 GMT
Additional comments
displaying the User Action logs is limited to super users only, the module Action Logsshould respect that permission rule.
I cannot confirm this issue with J3.9.0 Nightly https://developer.joomla.org/nightly-builds.html
There is no Latest Actions module to see for Manager(s) or Administrator(s). And they can't change module settings.
I also applied patch #21983 with PatchTester and used database fix button but I don't know if that pr is needed concerning this issue!
One can still create a new instance of the action logs and privacy requests modules separate from what is in the new install packages (and actually you have to when upgrading from 3.8 or earlier because we aren't arbitrarily adding new dashboard modules to an existing site). So the modules should probably perform some form of ACL check.
brianteeman
- | Labels |
Added:
J3 Issue
|
||
franz-wohlkoenig
- | Status | New | ⇒ | Discussion |
| Category | ⇒ | com_csp |
| Status | Discussion | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2018-09-18 17:57:57 |
| Closed_By | ⇒ | Quy |
| Closed_By | Quy | ⇒ | joomla-cms-bot |
Set to "closed" on behalf of @Quy by The JTracker Application at issues.joomla.org/joomla-cms/22236
Please test PR #22239
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/22236.
I guess you have to define yourself the Permissions for that module when creating it.