A reminder to restore permission before doing anything else

Ancient Viking · Post by **Ancient Viking** » Sun Aug 16, 2020 1:23 pm

A while back I tested the permissions for a member and when I wanted to restore it I couldn't find where I can restore my permission.

As frustrated as I was I logout then I couldn't login and I suspect that it has to do with me still testing the permissions for a member.

My idea has a few things that can prevent that from happening in the future.

1. Cannot logout as long permissions for a member are still in a testing mode, if feasible of course
2. Add a link or an icon or even a message somewhere in the forum, just as a reminder to restore permission before doing anything else

After a while, a couple of reinstallations later, I clicked on the members profile and there it had a "Restore Permission" option, which I think will only cause confusing and unnecessary troubles for anyone who is using phpBB.

AmigoJack · Post by **AmigoJack** » Sun Aug 16, 2020 10:09 pm

How should this work security wise? If you just give up and go to bed you cannot expect to still have the same session 3 days later (and thus being/getting logged in)... This approach would create all sorts of new problems just for trying to cure lazyness. Hello session hijacking.
In the default style that link is in the navigation bar (so you reach it from every page) and the message that you initially got (currently testing permission) already contains the link to restore your own ones, so you could bookmark it.

Ancient Viking · Post by **Ancient Viking** » Sun Aug 16, 2020 11:19 pm

AmigoJack wrote: ↑Sun Aug 16, 2020 10:09 pm In the default style that link is in the navigation bar (so you reach it from every page) and the message that you initially got (currently testing permission) already contains the link to restore your own ones, so you could bookmark it.

Where is the "Restore Permission" link?

I don't see it and right now I am testing the permission for a member.

Why do I need to bookmark something important? Give me one damn good reason why I need to bookmark that "Restore Permission" link.

Besides, even I bookmark it I still need to click on profile just to see the "Restore Permission" link, don't I.

My idea is to prevent that from happening and make it easier for all users regardless what experience and/or knowledge one has.

What you suggested is a waste of time and only creates more confusing. TBH, I don't think you understand what I am talking about, do you.

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Mon Aug 17, 2020 12:37 am

personally I think the whole thing is a mess. when you are testing a users permissions you are still an admin so you still have your admin permissions as well.
what good is it to test users permissions when you have admin permissions and can't really test what the user can or can not do?

I think it is much better to create a test account for yourself that does not have any admin or moderator permissions.
that way you can log in as that user and see what problems there might be as a normal user.

robert

**My CDB Contributions** · Post by **HiFiKabin** » Mon Aug 17, 2020 9:37 am

Ancient Viking wrote: ↑Sun Aug 16, 2020 11:19 pm Where is the "Restore Permission" link?

Ancient Viking · Post by **Ancient Viking** » Mon Aug 17, 2020 9:39 am

Lumpy Burgertushie wrote: ↑Mon Aug 17, 2020 12:37 am personally I think the whole thing is a mess. when you are testing a users permissions you are still an admin so you still have your admin permissions as well.

what good is it to test users permissions when you have admin permissions and can't really test what the user can or can not do?

I think it is much better to create a test account for yourself that does not have any admin or moderator permissions.
that way you can log in as that user and see what problems there might be as a normal user.

Agreed. Especially, when an admin who is testing permissions can logout and anyone can image what mess a hacker can do when having access to vital information e.g username, password etc about an admin or anyone else who have access to ACP.

I think phpBB should have an unique Founder class/group and the user is automatically added to a Founder class/group before setting up a forum.

adding forums
adding groups
changing permissions
installing extensions and/or styles

Things like that.

Ancient Viking · Post by **Ancient Viking** » Mon Aug 17, 2020 9:43 am

HiFiKabin wrote: ↑Mon Aug 17, 2020 9:37 am
Ancient Viking wrote: ↑Sun Aug 16, 2020 11:19 pm Where is the "Restore Permission" link?
screenshot_477.jpg

I know where it is.

I only responded to AmigoJack's post.

IIRC, phpBB 3.0.x had the restore permission link somewhere else and I think that was easier to notice than it is in phpBB 3.1.x or newer.

ssl · Post by **ssl** » Mon Aug 17, 2020 10:01 am

Hi
If you click on the ACP link you get a message telling you that you are using a member's permissions, and you are asked to restore your permissions.

Ancient Viking · Post by **Ancient Viking** » Mon Aug 17, 2020 10:06 am

ssl wrote: ↑Mon Aug 17, 2020 10:01 am Hi
If you click on the ACP link you get a message telling you that you are using a member's permissions, and you are asked to restore your permissions.

Right, tell me. Do you really think anyone, one who doesn't know much about phpBB, would know that?

Even if you're correct the question is. Where is the link to restore permission?

RMcGirr83 · Post by **RMcGirr83** » Mon Aug 17, 2020 10:13 am

Ancient Viking wrote: ↑Mon Aug 17, 2020 9:39 am I think phpBB should have an unique Founder class/group and the user is automatically added to a Founder class/group before setting up a forum.

When initially setting up the forum, the user setting it up is given founder status (set as the users type in the database). define('USER_FOUNDER', 3);

**My CDB Contributions** · Post by **HiFiKabin** » Mon Aug 17, 2020 10:57 am

So I am guessing that you want something like this

ssl · Post by **ssl** » Mon Aug 17, 2020 11:30 am

Yes, having a message at the top of the forum indicating that we are using permissions that are not ours would be more meaningful in this case

Ancient Viking · Post by **Ancient Viking** » Mon Aug 17, 2020 11:39 am

HiFiKabin wrote: ↑Mon Aug 17, 2020 10:57 am So I am guessing that you want something like this

screenshot_478.jpg

Yes. Exactly that!

But having that there, shown in the picture, could be messed up with the "Forum Rules" line that is also placed in the same spot.

ssl wrote: ↑Mon Aug 17, 2020 11:30 am Yes, having a message at the top of the forum indicating that we are using permissions that are not ours would be more meaningful in this case

I concur.

david63 · Post by **david63** » Mon Aug 17, 2020 11:42 am

HiFiKabin wrote: ↑Mon Aug 17, 2020 10:57 am So I am guessing that you want something like this

Isn't that what we had in phpBB 3.x?

I think that overall I am with Lumpy on this that "mimicking" a user's permissions is not that helpful

ssl · Post by **ssl** » Mon Aug 17, 2020 11:51 am

david63 wrote: ↑Mon Aug 17, 2020 11:42 am I think that overall I am with Lumpy on this that "mimicking" a user's permissions is not that helpful

Exactly, the best solution to test permissions is to create a user account and move it to a group for which you want to test permissions.

Since it is possible to test the permissions of the members, is it not possible to have an extension that would display a message at the top of the forum?

Votes

Status