› ›
CRITICAL SECURITY VERSION UPDATE:
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13

I just created a user with no permissions.

carlwenrichcarlwenrich
edited March 2012 in Bug Reports
Why does he have access to the dashboard?

Comments

  • adminadmin
    edited 3:16AM
    The dashboard is the only page that doesn't require specific permissions. The permission labeled "View the Manage Dashboard Page" refers to the "fuel/manage" page (which actually doesn't appear in the menu).
  • carlwenrichcarlwenrich
    edited 3:16AM
    That's my point. Why would you want to let a new user see the dashboard, which is to say the admin interface? A new user registering on a site is usually sent to his personal profile page.
  • adminadmin
    edited 3:16AM
    The dashboard was deemed to be a benign page that any user valid user in the system that logged in can go to whether they have permissions or not. The dashboard content itself can by different depending on the permissions. With regards to a new user registration, signing up in FUEL is a little different then signing up on a site because the initial signup needs to be done by an account that has the permissions to create users and assign proper permissions. After the initial signup a user can change their profile information including password but it is not required.
Sign In or Register to comment.