[SOLVED] CMS user permissions not enforced
Posted: Thu May 22, 2008 4:23 pm
In case anyone has the same problem upgrading from a very old CMSMS, here's the solution.
Problem 1: My CMSMS site only had two users: an Editor and an Admin. The Editor had almost no permissions set up, yet he could do everything that the Admin could do.
Solution: SELECT * FROM cms_users; showed that my Editor user had user_id=1. It turned out that user_id=1 and group_id=1 always have full admin rights in CMSMS (see check_permission() in /lib/page.functions.php), so the fix was to tweak the cms_users, cms_groups and cms_user_groups table data, such that only the admin account had user_id=1, group_id=1.
Problem 2: Installing the MenuManager module on 1.2.5 gave these errors in Postgres:
Solution: It turned out that /modules/MenuManager/method.install.php assumes that the admin group is called Admin, and that there is a designer group called Designer. So, the fix was to tweak cms_groups / cms_users / cms_user_groups accordingly. To match the default setup on a clean CMSMS install, the cms_groups need to be group_id=1 "Admin", 2 "Editor", 3 "Designer".
Cheers,
- Martin
Problem 1: My CMSMS site only had two users: an Editor and an Admin. The Editor had almost no permissions set up, yet he could do everything that the Admin could do.
Solution: SELECT * FROM cms_users; showed that my Editor user had user_id=1. It turned out that user_id=1 and group_id=1 always have full admin rights in CMSMS (see check_permission() in /lib/page.functions.php), so the fix was to tweak the cms_users, cms_groups and cms_user_groups table data, such that only the admin account had user_id=1, group_id=1.
Problem 2: Installing the MenuManager module on 1.2.5 gave these errors in Postgres:
Code: Select all
ERROR: invalid input syntax for integer: "f"
STATEMENT: SELECT count(*) FROM cms_group_perms WHERE group_id = 'f' AND permission_id = '44'
ERROR: syntax error at or near "," at character 111
STATEMENT: INSERT INTO cms_group_perms (group_perm_id, group_id, permission_id, create_date, modified_date) VALUES (158, , 44, '2008-05-22 13:10:15', '2008-05-22 13:10:15')
ERROR: invalid input syntax for integer: "f"
STATEMENT: SELECT count(*) FROM cms_group_perms WHERE group_id = 'f' AND permission_id = '44'
ERROR: syntax error at or near "," at character 111
STATEMENT: INSERT INTO cms_group_perms (group_perm_id, group_id, permission_id, create_date, modified_date) VALUES (159, , 44, '2008-05-22 13:10:15', '2008-05-22 13:10:15')
Cheers,
- Martin