[#7351] - Backend Templateediting only global SuperUser
- Closed
- 6 Jul 2015
- Medium
- Build: master
- # 7351
Steps to reproduce the issue
Login in Backend with an Admin user not SuperAdmin
Goto Template Manager: Customise Template
Expected result
Full editing and create Overrides
Actual result
Only the Template Description is visible
System information (as much as possible)
Joomla 3.4.3
Additional comments
Before updating from 3.4.1 to 3.4.2 or 3.4.3 you could edit the template or create Overrides.
Solution:
Implement ,'com_templates'
to
JFactory::getUser()->authorise('core.admin')
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-07-06 13:17:38 |
| Closed_By | ⇒ | Bakual |
Yes, normaly you can switch to SuperUser, but there are Permission for Configure ACL & Options.
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/7351.
It's actually trivial to give anybody Super User access if you can write to the database directly. It's trivial to write to the database directly when you can edit executable PHP code on the site. This article of mine is nearly five years old but the premise of injecting a Super User still holds: http://magazine.joomla.org/issues/issue-sept-2010/item/148-62-reasons-to-fire-your-super-admin It just needs a very slight modification for J! 3 which I will leave to the enterprising reader's imagination.
So, really, the template manager MUST NOT allow anyone besides Super Users to edit the template files. Do note that you can give core.admin privileges to the template manager but not the entire site which makes it different than being a Super User. With your proposed change the otherwise limited user would be able to escalate his privileges to full Super User (a.k.a. God Mode) which is a gaping security hole as @Bakual explained.
That is intended behavior. Only super users are allowed to modify files in the template manager.
Trying to restrict a users permissions while he can edit the files is pointless. He could raise his permissions to SuperUser within a minute.