Hi.
I have a site that I’ve set up.
I added a user with name ’test-user’.
I logged into the site with two seperate browsers: one for the site admin, one for test-user.
As test-user, using the ’Actions’ page, I went to edit the top menu bar for the user.
I wanted to remove a bunch of items, including Security, Users and Reports.
As test-user, I removed these.
In my other browser, as admin, after reloading the page, I can no longer see these items.
I’m probably just doing something dumb here. But I’d like to get the menu items back for the admin, while having them invisible for the test user.
If I try to restore these as test-user, I get the error message ’parent menu not found’.
As admin, I’ve been able to restore some of the menu items. I had to copy the url for the actions page that from test-user’s browser navigation bar into the browser that admin was using. Under ’top menu’ -> ’create menu’ I had the option to recreate some items. I’m still lacking ’components’ ’tools’ ’reports’ and ’support’.
The more I think about this, the more it looks to me like a security issue. At least to my untrained eye.
A user with limited privileges should not be able to effect the admins manager interface.
If users have ’menus’ and ’actions’ permissions in their mgr policy, they can modify the top menu at will because, with respect to the menus, you’ve made them admin Super Users. Their actions will affect all other users just like yours would. Removing the ’actions’ permission should prevent them from being able to do that.
The way to hide specific menu items from groups of users is not to remove them but to assign custom permissions to those menu items in System->Actions. Be sure to give yourself (as admin Super User) the permissions first, before adding the custom permissions to the menu items or they’ll disappear for you too and you’ll have to edit the DB to get them back.
