#1547 Unauthorized user creating groups?
On the motorola test project https://sourceforge.net/p/mtest/home/, Scott Osborne was able to go into the admin area and create the Kool and the Gang group, even without admin permissions.
On the motorola test project https://sourceforge.net/p/mtest/home/, Scott Osborne was able to go into the admin area and create the Kool and the Gang group, even without admin permissions.
Also note that the permission required is 'security', which by default is a permission held by the 'Admin' group.
I thought I had narrowed this down to users deleted from permission groups incorrectly retaining their permissions, but I can no longer reproduce this locally. Rick has some ideas about how to debug this better on the server so sending to him.
This is believed to be fixed -- we detected an instance where a user was in a group 'twice' and the user removal-from-group code would only remove one instance of the user. We should monitor for further problems along these lines, however, and particularly ask if Scott Osborne can reproduce the error once this commit is pushed.