Welcome to Geeklog, Anonymous Thursday, April 18 2024 @ 04:10 am EDT

Command & Control Showing Unauthorized Controls

Tuesday, May 13 2003 @ 01:34 am EDT
Contributed by: vbgunz
Views: 5,643

I just noticed this... Using Admin everything looks cool and signing in as a regular user, things are dandy *but* it seems whomever I give Command and Control access will see unauthorized controls....

Static pages - Chatterblock - Faqman - FileMgmt - Forum - Menu Editor and External pages show up in *their* command and control... *but* if they click on it they're faced with a Access Denied page...

Why is it these icons are showing up in the first place? The moderator clearly doesn't have access rights to static pages and most anything else... Also these plug-ins come from different developers but all have something in common for them to show up...

I am not nailing it... Has anyone seen this before or is this how it works by default?

Thanks for any info on this :)

Comments

Command & Control Showing Unauthorized Controls | 2 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Command & Control Showing Unauthorized Controls

Authored by: Dirk on Tuesday, May 13 2003 @ 04:06 am EDT

The plugins you mentioned need to be updated. I've already posted about this on the geeklog-modules mailing list back in December.

This is what I wrote:

Plugins should check for the proper access rights before returning an entry and icon for moderation.php from plugin_cclabel_<pluginname>.

For example, for the default Moderator account, I see icons for the Forum, the Chatterblock, and for my very own Classifads plugin even though the Moderator does not have Admin access to those plugins.

Actually, the change in the plugin API that allows a plugin to return an empty entry from plugin_cclabel_<pluginname> was only introduced in Geeklog 1.3.7, so I'd like to point it out to you here:

--- snip (from docs/history) ---
- Plugins can now return "false" (or an empty array) from
plugin_cclabel_<plugin-name> so that the plugin's icon does not show up in moderation.php if the user does not have the proper access rights for the plugin. Changed the Static Pages plugin to do exactly that.
--- snip ---

bye, Dirk

Command & Control Showing Unauthorized Controls

Authored by: vbgunz on Tuesday, May 13 2003 @ 06:00 am EDT

I must say, a thousand thank yous for your time. Without your help on these boards Dirk I could be dead in the water. I took what you said and worked on it not knowing a bit of php to help me out... I managed to fix all entries I believe were troublesome... Would you or someone else mind looking them over to make sure they're not time bombs as they seem to work like a charm...

I'd sure appreciate hearing a confirmation from these plugin developers. Also, since I tested it quite a bit and could not find any problems I guess this can be considered plugin fixes...

Thanks for your time and confirmation on this one :)

/**staticpages code*/

function plugin_cclabel_staticpages()
{
global $_CONF, $LANG_STATIC;

$retval = array();
if (SEC_hasRights('staticpages.edit')) {
return array($LANG_STATIC['staticpages'],$_CONF['site_admin_url'] . '/plugins/staticpages/index.php',$_CONF['site_url'] . '/staticpages/images/staticpages.png');
}
return $retval;
}

/**Chatterblock code*/

function plugin_cclabel_chatterblock()
{
global $_CONF,$cb_lang;

$retval = array();
if (SEC_hasRights('chatterblock.edit')) {
return array($cb_lang['prompt22'],$_CONF['site_admin_url'] . '/plugins/chatterblock/index.php',$_CONF['site_url'] . '/chatterblock/images/chatterblock.png');
}
return $retval;
}

/**External Pages code*/

function plugin_cclabel_external()
{
global $_CONF, $LANG_EX00;

$retval = array();
if (SEC_hasRights('external.admin')) {
return array($LANG_EX00['externpages'],$_CONF['site_admin_url'] . '/plugins/external/index.php',$_CONF['site_url'] . '/external/images/external.png');
}
return $retval;
}

/**File Management code*/

function plugin_cclabel_filemgmt()
{
global $LANG_FILEMGMT, $_CONF;

$retval = array();
if (SEC_hasRights('filemgmt.edit')) {
return array($LANG_FILEMGMT['plugin_name'],$_CONF['site_admin_url'] . '/plugins/filemgmt/index.php',$_CONF['site_url'] . '/filemgmt/images/filemgmt.png');
}
return $retval;
}

/**Forums code*/

function plugin_cclabel_forum()
{
global $_CONF;

$retval = array();
if (SEC_hasRights('forum.edit')) {
return array('Forum',$_CONF['site_url'] . '/admin/plugins/forum/index.php',$_CONF['site_url'] . '/forum/images/forum.png');
}
return $retval;
}

Thanks for checking :)

---
Victor B. Gonzalez

---
Victor B. Gonzalez -
http://aeonserv.com

Warning: Javascript required to enable functionality

Command & Control Showing Unauthorized Controls

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks