Permissions bug in Admin area

[caphun]

If a user is given add/edit/delete permissions to user objects, the user is then able to create other users with greater permissions than itself, even promoting others to superuser status. Furthermore that user could also turn itself super by editing profile. Running off latest SVN version.

[Marc Fargas]

I'd guess this would either mean:

• Field/Row level permissions, which are not (yet) implemented.
• Provide more fine-grained permissions.

So, it's not really a bug, but a feature request. You could say it's a gotcha if you wish ;)

I'll mark this post-1.0; But it's likely to die as "invalid" and maybe opened as "Provide finer control in contrib.auth" when the above gets implemented ;)

[caphun]

You really got me there :)

I honestly did not anticipate that by giving a non-superuser the ability to add other users is equivalent to making them a superuser (by implication that is ;)

Can't wait to see this "feature" included. Hope it's not at the bottom of the list!

[anonymous]

This is quite a serious flaw. Please can we have this feature included!

[(none)]

Milestone post-1.0 deleted

[Jacob]

Without any sort of row-level permissions -- which, at the moment, is nowhere near even being considered for addition -- this is impossible.