1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

As Designed Going to admin group without permission loads page...

Discussion in 'Resolved Bug Reports' started by Liam W, Jul 2, 2015.

  1. Liam W

    Liam W Well-Known Member

    Didn't know how to explain what I mean, and still don't...

    Basically, if you don't have permission to say, manage users, but you go to admin.php?users, you still get the users page (albeit blank).

    This is more obvious with development tools - the entire page loads, with all the page picture links (it just has the home tab selected).

  2. Chris D

    Chris D XenForo Developer Staff Member

    For the users case this seems to be deliberate. The pre dispatch in the User controller specifically bypasses the permission check for the index. I'm not entirely sure why (I can't see an obvious reason) so we'll have a closer look.
  3. Mike

    Mike XenForo Developer Staff Member

    This is generally deliberate, though there are tweaks that need to be made.

    In most cases, the top level "tab" navigation doesn't directly enforce permissions. It works by hiding the tab if the user doesn't have access to anything within. This allows add-ons to add things that depend on different permissions, for example. If we didn't "allow" access to the index page of the section, you'd click the tab -- despite having access to things in the tab -- and get a no permission action. A blank page isn't necessarily ideal, but I think it's better than a permission error.
    Steve F and Liam W like this.

Share This Page