Loading...
 
Skip to main content

Features / Usability

Forum List Topic List

 
Thread actions
Print this page
  • Print all pages

    • normal users able to set login to admin

    Posted by plamping

    😕
    I have Tiki Wiki 1.8.3 running on a Linux 2.4.14 kernel with MySQL 4.0.20 and PHP 4.3.7. I have it setup so that only registered users can enter the site. They won't get past the login page otherwise. After they login, they have a login module on the right that says "logged as: <username>," "Logout," and "user: Set."

    I've tested this and any user can enter "admin" in the entry box and press "Set" and then it says "logged as: admin." I have confirmed they do indeed have admin rights.

    I use "Just Tiki" for my authentication. Can I either prevent setting to admin or disable the "User: Set" option in the login menu?

    Paul
    Tiki Wiki is otherwise working wonderfully.

    Reads: 1033
    Posted by Damian Parker

    Under your Admin menu choose Groups, and I bet you have given registered the tiki_p_admin permission

    Damian


    Posted by plamping

    Yes, that was inadvertantly added into one of the groups. After removing it, I no longer got the "user: _ Set" option in the login box.

    I was worried for a while because then I couldn't login with my normal user (I have a restricted site). I fixed that by adding 'tiki_p_access_closed_site' to one of my groups.
    😎