Security Problem with Web Invoice — in confering access to non Admins | Mohanjith

Security Problem with Web Invoice — in confering access to non Admins

This topic has 3 replies, 2 voices, and was last updated 14 years, 5 months ago by S H Mohanjith.

Viewing 4 posts - 1 through 4 (of 4 total)

Author

Posts
November 28, 2009 at 10:20 #3472

jc
Member

Dear great one,

I gave an editor access to web invoice and found out that he could in turn, now, give access to contributors, writers, etc…how can I prevent this, so that only I the admin can grant access to a specific status?

This is a big security problem because someone can change the settings and send out invoices to their paypal account rather than that of my site…

Am I confused…and not understanding how to use this plugin?

November 28, 2009 at 12:34 #4693

S H Mohanjith
Member

Have you set the “Minimum User Level to Manage web-invoice” in “Web Invoice” -> “Settings” ? I’m unable to reproduce your issue.

Make sure you are running latest version of Web Invoice (and not WP-Invoice).

November 28, 2009 at 15:25 #4696

jc
Member

Yes I did, that is how I a granted the editor access. I just talked about this also under the issue of capability manager compatability. see mroe there

November 29, 2009 at 07:50 #4699

S H Mohanjith
Member

Anyone else please see https://www.mohanjith.com/forum/topic.php?id=51
Author

Posts

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.