Facebook
Twitter
Username: Peter Debik
TITLE
A user role limited to "database management" only can still change the PHP version used for the website
PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
Obsidian, latest MU
CentOS 7.9
PROBLEM DESCRIPTION
A user account that has been created within a subscription and only has the privileges "database" is able to change the PHP version and interface from the "Hosting Settings" link. Such a user would be able to break a website.
STEPS TO REPRODUCE
1) Create a user-defined role and grant only the "database" privileges to that role.
2) Create an additional user in the subscription and associate that user with the database-only role.
3) Login with that user.
4) Click on "Websites & Domains", then "Hosting Settings".
5) Change PHP version or handler, click "OK".
6) Logout, login as the subscription user to verify that version and handler have been changed, although the user had only privileges to manage databases.
ACTUAL RESULT
User can apply changes to PHP version and handler.
EXPECTED RESULT
User should not be able to edit anything but database settings if his privileges are limited to database maintenance.
ANY ADDITIONAL INFORMATION
YOUR EXPECTATIONS FROM PLESK SERVICE TEAM
Confirm bug
TITLE
A user role limited to "database management" only can still change the PHP version used for the website
PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
Obsidian, latest MU
CentOS 7.9
PROBLEM DESCRIPTION
A user account that has been created within a subscription and only has the privileges "database" is able to change the PHP version and interface from the "Hosting Settings" link. Such a user would be able to break a website.
STEPS TO REPRODUCE
1) Create a user-defined role and grant only the "database" privileges to that role.
2) Create an additional user in the subscription and associate that user with the database-only role.
3) Login with that user.
4) Click on "Websites & Domains", then "Hosting Settings".
5) Change PHP version or handler, click "OK".
6) Logout, login as the subscription user to verify that version and handler have been changed, although the user had only privileges to manage databases.
ACTUAL RESULT
User can apply changes to PHP version and handler.
EXPECTED RESULT
User should not be able to edit anything but database settings if his privileges are limited to database maintenance.
ANY ADDITIONAL INFORMATION
YOUR EXPECTATIONS FROM PLESK SERVICE TEAM
Confirm bug
