Administrators can't view or edit users in backend - hacking attempt VM 3.0.10

[lindapowers]

Hi

Permissions works in all cases for administrators but not when editing or viewing users.

In this case the administrator will get prompted with a "hacking attempt" message and will be redirected to his own details.

Please note Im talking about administrators not super users, I believe that is why this bug may still be present since it was commented here http://forum.virtuemart.net/index.php?topic=124536.0

Regards

VirtueMart 2.6.14 Joomla! 2.5.25

[lindapowers]

Ill cry once more for this, our workers (administrators) can't edit users in the backed and that is a pain! We dont want to give them access to mess VM settings, please we need a solution for this,

Regards

[Milbo]

It is definitly fixed for vm3. I dont know why it does not work for you in vm2.6.14

[lindapowers]

It is definitly fixed for vm3. I dont know why it does not work for you in vm2.6.14

I think it doesn't work for anyone in VM 2.6.14, only a few mentioned it as I believe not much of us use administrators as vendors removing the super user privilege.

I tried in 3 different installations and happened the same but anyway ill wait till we update to VM3.

Regards

[lindapowers]

I've seen several topics relating to permission issues.


VM 3.0.10 now

Administrators can't edit user details in the backend:

Saving details will show:

Error

vmError: Hacking attempt uid check, you got logged

And changes wont be saved either.


We still have to give our administrators full access to configuration etc or they are not able to edit customer details in the backend.

[Milbo]

Seems you miss something http://docs.virtuemart.net/manual/general-concepts/185-administrative-frontend-access-with-acl.html

It is working very good for us and we use the system intensivly in our own live store.

vmError: Hacking attempt uid check, you got logged
And changes wont be saved either.

Of course not, you are recognised as hacker, it would be strange if it would update the data, even you are recognised as hacker.

[lindapowers]

Seems you miss something http://docs.virtuemart.net/manual/general-concepts/185-administrative-frontend-access-with-acl.html

It is working very good for us and we use the system intensivly in our own live store.

vmError: Hacking attempt uid check, you got logged
And changes wont be saved either.

Of course not, you are recognised as hacker, it would be strange if it would update the data, even you are recognised as hacker.

Hi Max thanks read documentation carefully but nothing changes, please check this post https://forum.virtuemart.net/index.php?topic=124536.0

I think the bug is present still.

Configure ACL & Options to "Denied" for an administrator wont allow him to edit shopper details, even with the "edit users" allowed.

[lindapowers]

Ok Max a developer fixed this for us and now is working. Please check it since this happens even in latest VM.


The fix is done in administrator/components/com_virtuemart/tables/userinfos.php

I copied you what he said and upload the file renamed to txt with the fixes for VM 3.0.11

He said he added a simple check for $user->authorise('vm.user.edit','com_virtuemart' which was missing

remove this lines
   if(!vmAccess::manager('core')){
    $q = "SELECT virtuemart_user_id
          FROM #__virtuemart_userinfos
          WHERE virtuemart_userinfo_id = ".$this->virtuemart_userinfo_id;
    $this->_db->setQuery($q);
    $total = $this->_db->loadColumn();

    if (count($total) > 0) {

     $userId = JFactory::getUser()->id;
     if($total[0]!=$userId){
      vmError('Hacking attempt uid check, you got logged');
      echo 'Hacking attempt uid check, you got logged';
      return false;
     }
    }
   }

and replace with

   if(!vmAccess::manager('core')){
    $user = JFactory::getUser();
    if(!$user->authorise('vm.user.edit','com_virtuemart') ) {
     $q = "SELECT virtuemart_user_id
           FROM #__virtuemart_userinfos
           WHERE virtuemart_userinfo_id = ".$this->virtuemart_userinfo_id;
     $this->_db->setQuery($q);
     $total = $this->_db->loadColumn();

     if (count($total) > 0) {

      $userId = $user->id;
      if($total[0]!=$userId){
       vmError('Hacking attempt uid check, you got logged');
       echo 'Hacking attempt uid check, you got logged';
       return false;
      }
     }
    }
   }

[Milbo]

Thank you,

should be then

Code Select Expand


if(!vmAccess::manager('user.edit')){
.............
}


all $user->authorise is forbidden in vm code and vmAccess checks for admin automatically.