Posted by salvis on August 10, 2011 at 11:06pm
2 followers
Jump to:
| Project: | RoleAssign |
| Version: | 7.x-1.0-rc1 |
| Component: | Miscellaneous |
| Category: | task |
| Priority: | critical |
| Assigned: | salvis |
| Status: | needs review |
Issue Summary
This issue serves to track progress porting 6.x-1.0 to Drupal 7.
Comments
#1
We have BETA1 of RoleAssign.
Please test this version and provide feedback, both good and bad:
IF this module works for you, please let us know by adding a note to THIS issue below.
IF YOU FIND A BUG, please check the issues queue, and if it hasn't been reported yet, then OPEN A NEW ISSUE!
PLEASE do NOT add bug reports / questions to this issue here.
#2
We have BETA2 of RoleAssign.
Prior versions of RoleAssign had (and other modules with similar functionality may still have) two vulnerabilities:
1. Users with the Administer users permission were able to manipulate and obtain access to the uid 1 account and other accounts having the Administer permissions permission, even if they were restricted by RoleAssign.
2. If they happened to also have the Administer modules permission, they were able to disable RoleAssign and thus obtain the ability to assign all roles.
BETA2 (as well as 6.x-1.x-dev) eliminates both of these vulnerabilities.
Please test this version and provide feedback, both good and bad:
IF this module works for you, please let us know by adding a note to THIS issue below.
IF YOU FIND A BUG, please check the issues queue, and if it hasn't been reported yet, then OPEN A NEW ISSUE!
PLEASE do NOT add bug reports / questions to this issue here.
#3
We have RC1 of RoleAssign.
RC1 has some clean-up work that should not result in any functional changes. Nonetheless, this is the last chance to provide feedback before the 1.0 release. We currently have 150 sites using the D7 version and no one has cared to post a comment yet...
Please test this version and provide feedback, both good and bad:
IF this module works for you, please let us know by adding a note to THIS issue below.
IF YOU FIND A BUG, please check the issues queue, and if it hasn't been reported yet, then OPEN A NEW ISSUE!
PLEASE do NOT add bug reports / questions to this issue here.
#4
Used RC1 on a production site and so far it seems fine. Thanks.
#5
Thank you, sjhuda!
Everyone please note #1356964: Hide the Administrator role selection in admin/config/people/accounts unless the user has the 'administer permissions'. Add your comments there if you want, not here, please!