Sector Nord AG: Editing own extended agent preferences is not possible #580
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
NiklasSchmitt
suggested changes
Jul 11, 2024
There was a problem hiding this comment.
Hi,
removing the condition && $EditUserID != $Self->{UserID} would result in other issues while saving preferences for other agents and/or own preferences. This is not the right way to resolve the explained issue.
A better solution would be to have a deeper look into AgentPreferences and verify that GET-parameter EditUserID is always set to the following requests again when given.
Best regards,
Niklas
|
Is there a bug report for this? |
|
Hi, |
jsinagowitz
changed the title
dennykorsukewitz
removed
the
3 - wait for contributor
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed change
Some agent preferences can only be edited by admins, e.g.
PreferencesGroups###Comment.To edit them you need to go to:
Admin -> Agents -> Choose an agent -> "Edit personal preferences for this agent" -> "Miscellaneous"
Since this commit there is a bug when editing the own "extended" preferences.
When clicking on "Edit personal preferences for this agent" the URL contains the UserID of the target user that should be edited:
/znuny/index.pl?Action=AgentPreferences;EditUserID=1If I am UserID 1 and want to edit UserID 1 the parameter is beeing removed after clicking on "Miscellaneous":
/znuny/index.pl?Action=AgentPreferences;Subaction=Group;Group=MiscellaneousIf I edit another User, the URL contains the parameter correctly:
/znuny/index.pl?Action=AgentPreferences;Subaction=Group;Group=Miscellaneous;EditUserID=2If the parameter "EditUserID" is missing, not all agent preferences are shown, e.g. "Comment" is missing. So it is not possible to edit the comment preferences for the own user. You need to ask a different admin user or add the parameter "EditUserID" to the URL.
Type of change
Additional information
I found out that the bug was built into Znuny 7 with this commit: a9dd66c
I have also tested changing the settings of another agent as an agent (not admin) by adding the parameter manually. However, this is correctly recognized and intercepted by Znuny, so that it is not possible to change other settings without permission.
Checklist