#218 Do not allow non-administrators to see list of users

open
nobody
None
2
2013-07-29
2013-07-15
Anonymous
No

We regard the ability for non-administrators to see the list of all users in edit_users.php as a security risk and data privacy issue. Non-administrators should only be able to see their own details.

I have modified edit_users.php to default to Action=Edit for non-admin users, selecting their own record, regardless of the Action and Id specified in the URL. Not pretty but it overcomes the problem. See lines 265-278 of attached code.

1 Attachments

Discussion

  • There's already a config setting that should achieve what I think you want. Set

    $auth['only_admin_can_see_other_users'] = TRUE;
    

    in your config file.

    Campbell

     

  • Anonymous
    2013-07-24

    Thanks - I had overlooked that one. Will implement as stated, as I prefer to stick to base code.

    However, I think that to take the user direct to the Edit screen would be friendlier than the current functionality, which shows the user a list (containing only themself) and expecting them to click on it to get to the edit screen.

     

  • Anonymous
    2013-07-29

    I have resolved the functional issue I described by checking the user privilege level in header.inc and parameterising the call to edit_users.php as required. Thanks for your help.

     


Anonymous


Cancel   Add attachments