Giters

pyrocms / pyrocms

Pyro is an experienced and powerful Laravel PHP CMS.

Home Page:https://www.pyrocms.com/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Users Module - User with lessor permissions cant reset PW (PyroCMS 3.8)

s-mcdonald opened this issue · comments

commented

I have a user in the system with CP access and access to manage users.

The permissions on this user are defined in a role and are shown in the below screenshot.
image

As that user, I navigated to admin/users and went to reset PW. I was prompted with the following error. Note that Changing the PW from "edit" was OK, this was from selecting the blue button with the gear icon and selecting "reset Password"

image

To Reproduce
Steps to reproduce the behavior:

  1. As Admin create a Role: "SiteOwner"
  2. Set the following permissions
  • Access CP
  • Can access Users Section
  • Can create and edit users
  • Can impersonate Users
    (i dont think these permissions are the catalyst, but these are the steps I took)
  1. Assign a user with the "SiteOwner"
  2. Login as the new User
  3. Go to admin/users/ and click on "Gear Icon->Reset Password"

Expected behavior
Change the Password

Desktop (please complete the following information):

  • OS: Windows 10 WSL Ubuntu
  • Browser : Edge and Chrome
commented

Arg, this is not Pyro - it looks like that is a mailer response. This works as expected best I can tell. You can't reset admin passwords but a nice message is flashed.