|
   |
| uCoz Community uCoz Modules Site Users Exploit |
| Exploit |
screenshot : http://mihaiantoce.ucoz.ro/Untitled.png
Moderators with the ability to use "Admin bar" can chose the option "view site as administrator" and gain administrator privileges. This is a HUGE exploit and a security breach. Post edited by mihai9987 - Sunday, 2014-09-07, 11:53 AM
|
mihai9987, the site's administration features - including the admin bar - are for administrative purposes. In a uCoz sense as a CMS this means the management of the website; not simply the moderation of. What extra features does the admin bar provide for your Moderators that the standard user bar would not?
You are correct, in what you say - I'm simply trying to understand your position on the matter.  I don't believe there are currently plans to change this feature.
Jack of all trades in development, design, strategy.
Working as a Support Engineer. Been here for 13 years and counting. |
You can disable the admin bar by going to your control panel.
Go to http://mihaiantoce.ucoz.ro/admin and then: Users (Left Menu) >> User groups >> Set permission for all groups >> Other Check or uncheck the "Access to Admin Bar." Click the link for more info on this matter: http://forum.ucoz.com/forum/31-2189-1 |
Eriko, I want to keep the admin bar for my moderators as its easier for them to moderate comments overall, but they can simply exploit it by giving themselves administrator permissions. I just want the option "View site as" removed. What do you guys think ?
Paradox, If you have acces to the admin bar, you can make yourself any group that you want. A moderator can become an administrator, thus you can have acces to all administration functions like File Manager, Edit site design, Builder, which you would normally be unable to acces. In conclusion, the option "View site as" , can be used by moderators to become administrators and thus enabling them to acces "file manager, site design and builder , as well as Mass PM dispatch" Post edited by mihai9987 - Sunday, 2014-09-07, 12:11 PM
|
mihai9987, disable the option "Access to Admin Bar" for Moderators. They will still have access to Admin Bar but it's limited version: they will be able to manage comments, but won't have the option "View site as".
I'm not active on the forum anymore. Please contact other forum staff.
|
| |||
| |||