View Issue Details

Jump to NotesJump to History
This issue affects 1 person(s).
 4
IDProjectCategoryView StatusDate SubmittedLast Update
10924Bug reportsUser / Groups / Rolespublic2016-04-12 10:152016-04-21 16:00
Reporterfvanderstarre Assigned Toc_schmitz  
PrioritynoneSeveritypartial_block 
Status closedResolutionno change required 
Product Version2.06+ 
Summary10924: User without view users permission can still see all other users
Description

A user without any global permissions set for users still can see all other users in user administration (e.g. when changing password)

Steps To Reproduce

Create a user with no global permission for creating/updating/deleting/viewing users. Log in as this user, click User Administration. A list of all users with their email addresses and full names is displayed. This should not happen.

TagsNo tags attached.
Bug heat4
Complete LimeSurvey version number (& build)2.06+ build 160129
I will donate to the project if issue is resolvedNo
BrowserAny
Database type & versionMS SQL server 2008R2 10.50.6220 (X64)
Server OS (if known)DB server: Windows NT 6.1 <X64> build 7601 SP1
Webserver software & version (if known)Linux RHEL 7, Apache 2.4.6
PHP Version5.6.19
Git branch / Pull Request URL

Users monitoring this issue

There are no users monitoring this issue.

Activities

c_schmitz

c_schmitz

2016-04-21 15:36

administrator   ~37660

I cannot reproduce that.
DO you maybe have "Group member can only see own group:" deactivated in the Global settings/security tab?
fvanderstarre

fvanderstarre

2016-04-21 15:41

reporter   ~37661

Yes. That explains a lot... Thx!
fvanderstarre

fvanderstarre

2016-04-21 15:44

reporter   ~37662

What about users not in a group?
c_schmitz

c_schmitz

2016-04-21 16:00

administrator   ~37665

They can't see anyone else if the setting is activated.

Issue History

Date Modified Username Field Change
2016-04-12 10:15 fvanderstarre New Issue
2016-04-13 12:02 c_schmitz Assigned To => c_schmitz
2016-04-13 12:02 c_schmitz Status new => assigned
2016-04-21 15:36 c_schmitz Note Added: 37660
2016-04-21 15:36 c_schmitz Status assigned => feedback
2016-04-21 15:41 fvanderstarre Note Added: 37661
2016-04-21 15:41 fvanderstarre Status feedback => assigned
2016-04-21 15:44 fvanderstarre Note Added: 37662
2016-04-21 16:00 c_schmitz Note Added: 37665
2016-04-21 16:00 c_schmitz Status assigned => closed
2016-04-21 16:00 c_schmitz Resolution open => no change required
2019-11-01 17:26 c_schmitz Category User/User groups => User / Groups / Roles