Loading...
 
Skip to main content

Users (without admin perms) are able to create blogs in other user's name

  • Tracker item actions
Trackers
Items
Status
Closed
Subject
Users (without admin perms) are able to create blogs in other user's name
Version
2.x
Category
  • Feature request
  • Patch
Feature
Blog
Permission
Resolution status
Fixed or Solved
Submitted by
zorp
Rating
(0)
Description

With the 1.10b (and latest svn changes) it is meant for admins to be able to change the creator of the forums.

Unfortunately, all users with permission to create blogs, can now create blogs for any other user - even if they can not post to them.

It seems that the latest file templates/tiki-edit_blog.tpl and .php requires that a value for the creator is passed back from the field Creator. Thus, the field has to be present with a valid content.

Solution

I'm sure there is an easier way of doing this but here is a solution:

In the file templates/tiki-edit_blog.tpl
Replace:
<tr class="editblogform"><td>Creator{/tr}</td><td><select name="creator">
{foreach from=$users key=userId item=u}
<option value="{$u|escape}"{if $u eq $creator} selected="selected"{/if}>{$u}</option>
{/foreach}
</select></td></tr>

with:
<tr class="editblogform"><td>Creator{/tr}</td>
{if $tiki_p_admin eq 'y' or $tiki_p_blog_admin eq 'y'}
<td><select name="creator">
{foreach from=$users key=userId item=u}
<option value="{$u|escape}"{if $u eq $creator} selected="selected"{/if}>{$u}</option>
{/foreach}
</select> </td>
{else}
<td>{$user}</td>
{/if}
</tr>

This solution still shows the menu if the user has admin privs but if the user does not have admin privs, the user name will simply show up as static text next to Creator.

The solution works for previews as well.

Importance
6
Priority
30
Demonstrate Bug on Tiki 19+
Demonstrate Bug (older Tiki versions)
Ticket ID
1787
Created
Tuesday 27 May, 2008 23:38:21 UTC
by Unknown
LastModif
Thursday 29 May, 2008 07:14:46 UTC


Show PHP error messages