Managing User Loggin in DB

Quick permission check that should probably be included in Susan’s changes:



Basically, we shouldn’t allow the person to clear the logs unless they also have the "logs" permission.

The optimize_table.processor.php file contains the security check to prevent such changes.

The user must have $modx->hasPermission(’settings’) in order to Optimize or Truncate the tables. The $modx->hasPermission(’logs’) check is used to check whether or not the user is able to view the system logs.

But I see your point. They should not be able to click anything if they don’t have access to change it, correct?

Yep. Seems to me, though, that they need both. Otherwise it is possible for someone who cannot see the logs to wipe them out. Not sure I like that, as it smacks of a good way to hide the fact that you are up to no good. Maybe I’m just paranoid, though.

hmmm,

Well it would appear to me that since they already have the right to change system settings then they can do just about anything with the logs.

I’ll add the check to the optimize_table file

Aha, looking at the userlogs.processor.php file I see that I forgot to un-comment the permission check! Basically, I used the same processor as the one for optimizing the tables.