Hi
Permissions works in all cases for administrators but not when editing or viewing users.
In this case the administrator will get prompted with a "hacking attempt" message and will be redirected to his own details.
Please note Im talking about administrators not super users, I believe that is why this bug may still be present since it was commented here http://forum.virtuemart.net/index.php?topic=124536.0
Regards
VirtueMart 2.6.14 Joomla! 2.5.25
Ill cry once more for this, our workers (administrators) can't edit users in the backed and that is a pain! We dont want to give them access to mess VM settings, please we need a solution for this,
Regards
It is definitly fixed for vm3. I dont know why it does not work for you in vm2.6.14
Quote from: Milbo on January 23, 2015, 21:47:44 PM
It is definitly fixed for vm3. I dont know why it does not work for you in vm2.6.14
I think it doesn't work for anyone in VM 2.6.14, only a few mentioned it as I believe not much of us use administrators as vendors removing the super user privilege.
I tried in 3 different installations and happened the same but anyway ill wait till we update to VM3.
Regards
I've seen several topics relating to permission issues.
VM 3.0.10 now
Administrators can't edit user details in the backend:
Saving details will show:
Error
vmError: Hacking attempt uid check, you got logged
And changes wont be saved either.
We still have to give our administrators full access to configuration etc or they are not able to edit customer details in the backend.
Seems you miss something http://docs.virtuemart.net/manual/general-concepts/185-administrative-frontend-access-with-acl.html
It is working very good for us and we use the system intensivly in our own live store.
Quote
vmError: Hacking attempt uid check, you got logged
And changes wont be saved either.
Of course not, you are recognised as hacker, it would be strange if it would update the data, even you are recognised as hacker.
Quote from: Milbo on October 09, 2015, 08:27:52 AM
Seems you miss something http://docs.virtuemart.net/manual/general-concepts/185-administrative-frontend-access-with-acl.html
It is working very good for us and we use the system intensivly in our own live store.
Quote
vmError: Hacking attempt uid check, you got logged
And changes wont be saved either.
Of course not, you are recognised as hacker, it would be strange if it would update the data, even you are recognised as hacker.
Hi Max thanks read documentation carefully but nothing changes, please check this post https://forum.virtuemart.net/index.php?topic=124536.0
I think the bug is present still.
Configure ACL & Options to "Denied" for an administrator wont allow him to edit shopper details, even with the "edit users" allowed.
Ok Max a developer fixed this for us and now is working. Please check it since this happens even in latest VM.
The fix is done in administrator/components/com_virtuemart/tables/userinfos.php
I copied you what he said and upload the file renamed to txt with the fixes for VM 3.0.11
He said he added a simple check for $user->authorise('vm.user.edit','com_virtuemart' which was missing
Quoteremove this lines
if(!vmAccess::manager('core')){
$q = "SELECT virtuemart_user_id
FROM #__virtuemart_userinfos
WHERE virtuemart_userinfo_id = ".$this->virtuemart_userinfo_id;
$this->_db->setQuery($q);
$total = $this->_db->loadColumn();
if (count($total) > 0) {
$userId = JFactory::getUser()->id;
if($total[0]!=$userId){
vmError('Hacking attempt uid check, you got logged');
echo 'Hacking attempt uid check, you got logged';
return false;
}
}
}
and replace with
if(!vmAccess::manager('core')){
$user = JFactory::getUser();
if(!$user->authorise('vm.user.edit','com_virtuemart') ) {
$q = "SELECT virtuemart_user_id
FROM #__virtuemart_userinfos
WHERE virtuemart_userinfo_id = ".$this->virtuemart_userinfo_id;
$this->_db->setQuery($q);
$total = $this->_db->loadColumn();
if (count($total) > 0) {
$userId = $user->id;
if($total[0]!=$userId){
vmError('Hacking attempt uid check, you got logged');
echo 'Hacking attempt uid check, you got logged';
return false;
}
}
}
}
Thank you,
should be then
if(!vmAccess::manager('user.edit')){
.............
}
all $user->authorise is forbidden in vm code and vmAccess checks for admin automatically.