Ticket #6662 (closed defect: fixed)

Opened 3 months ago

Last modified 3 months ago

Users without capability "create_users" can add new users

Reported by: imwebgefunden Assigned to: anonymous
Priority: high Milestone: 2.5.1
Component: Security Version: 2.5
Severity: critical Keywords:
Cc:

Description

If a user has the capability "edit_users" and not the capability "create_users" he can add new users. The defect is in admin-ajax.php. The check is against "edit_users" and not "create_users". I've attached a patch to fix this issue. A second one - more an AddOn? and not an defect: We should show the add user form only if the current user has the capability to add a new user. If the current user has the capability "create_users" the form will be shown. The second patch I attached make this job.

Attachments

ajax_create_users.diff (381 bytes) - added by imwebgefunden on 04/10/08 13:17:45.
Patch for admin-ajax.php to check against "create_users"
hide_create_user_form.diff (365 bytes) - added by imwebgefunden on 04/10/08 13:22:19.
Show "Add User" Form only if the current user can create new users

Change History

04/10/08 13:17:45 changed by imwebgefunden

  • attachment ajax_create_users.diff added.

Patch for admin-ajax.php to check against "create_users"

04/10/08 13:22:19 changed by imwebgefunden

  • attachment hide_create_user_form.diff added.

Show "Add User" Form only if the current user can create new users

04/10/08 13:24:12 changed by imwebgefunden

  • severity changed from normal to critical.

04/14/08 16:56:58 changed by ryan

  • status changed from new to closed.
  • resolution set to fixed.

(In [7659]) Check create_users cap instead of edit_users wgen adding/inserting users. Props imwebgefunden. fixes #6662 for 2.5

04/14/08 16:57:33 changed by ryan

(In [7660]) Check create_users cap instead of edit_users wgen adding/inserting users. Props imwebgefunden. fixes #6662 for trunk