Recent Topics

1 May 31, 2008 20:25    

My b2evolution Version: 2.x

Request for ideas, help or fixes please....

Guest bloggers are able to delete/edit other peoples blogs, even though their permissions level is set at zero -0-

How can we make this more secure?
Thanks,
-Don

2 May 31, 2008 20:49

This is NOT a "security breach". This is a feature of this blog application - believe it or not. How else, pray tell, would you have a collaborative work environment if blogger N could not edit the work of blogger Z? Or how could you assign the task of 'review and publish' the work of any blogger to any member of the RnP group (assuming that was your needs)?

So here's the deal: set up your permissions so that a user can not edit posts by other users. For a multi-blogger environment I manage I put bloggers into a specific group. On the blog that all members can post into I made that group be "moderators" which means they can edit the posts of someone with a lower level than their own. Since everyone ( ... except for 2 very special players) are level 1, no one (except the 2 special players) can edit anyone else's posts.

The relationship between user perms and group perms and levels and permissions is very complex, but it actually works out to give you fairly granular control over who can do what with what. Check it out a bit and you'll see that yeah it's cool.

BTW "security breach" normally refers to something significant. Like passwords or server access. Editing a post is NOT a security issue ... unless you give permissions to someone you don't know and/or don't trust. But hey *you* gave them the permissions right?

3 Jun 02, 2008 19:43

Hey Thanks...... :)

I will play around with it awhile. This is a Members Only Blog with a Public Blog and we just don't want anybody to edit anyone elses comments on the blogs except Admin.

THANKS AGAIN!
-Don

4 Jun 03, 2008 16:33

I think editing comments will follow permissions for editing posts, but I do not know that for sure so ... hey I guess you'll be the expert soon :)

5 Jun 03, 2008 17:33

Allowing "edit comments" allows the user to edit all comments ( tad like a moderator on a forum ), there is no easy way to kill this behaviour :(

¥

6 Jun 07, 2008 03:43

Yep..., it seems the more I play with it the more it is coming around to my way of thinking. If I play with it enough maybe.... just maybe, I will have some exciting news soon.... er ah, well you know what I mean.

B) .. bCool
-Don


Form is loading...