PP 5.62: Guest can delete images without this userright in admin panel!

[snoopy5]

PP 5.62: Guest can delete images without this userright in admin panel!

Hi,

we have a usergroup called "test account". This usergroup is allowed to upload images, but not to delete. Maximum disk space 1MB.

Now they found a trick how to delete their photos although in the user control panel this group is not allowed to delete at all.

I need a fix for this asap, since this trick is spreading like fire since Monday on my board.

The way how they do this trick:

1. They go in their own user profile and click on "statistics".

2. They click on "manage photos" and select the specific category in which they want to delete the image

3. They check "delete" on teh right side, click on the button and the image is deleted although this user does not have the right to do it.

I can uplaod screenshots later on too

How can I fix this asap?

[snoopy5]

Here are the screenshots:

[Chuck S]

This is right in the profile template

Content visible to verified customers only.

You have it set so users can delete photos in your admin option hense this is why this is shown.

[snoopy5]

Originally Posted by Chuck S

This is right in the profile template

Content visible to verified customers only.

You have it set so users can delete photos in your admin option hense this is why this is shown.

This is correct. But this only a general/global setting. General settings in PP are overwritten normallly with more specific settings for each usergroup. This is the whole sense of the usergroups IMHO.

In admin CP "Edit Usergroups" I can choose which usergroup is allowed to do what.

There is a special setting for editing photos for each usergroup seperately: "Allow edit own photos?"

For my usergroup "test accounts/guests", I set this option to "no".

So this just should not happen at all, this is why I posted it in the bug section. My usergrpup is not allowed to edit any photos. Editing includes deleting.

This works only, if a user sees his image in plain view by clicking on it. Then the delete option is not shown to him, which is correct.

Only if he is using the trick over the "statistics" he can "break" the "no editing" setting of his usergroup.

How can this be fixed?

Thanks in advance

[Chuck S]

Well you can try adding this in bold where noted on that line

Content visible to verified customers only.

[snoopy5]

Thanks, that worked...

Could you forward this to Michael so it is included in the next update of the download file?

For the customization work, I will send you an e-mail this week. I collected some good ideas from my moderators...