Welcome to ProjeQtOr new Forum. We migrated old forum to the new website.
You will find all your posts here, with your usual account.
Just one point : you’ll have to reinitialize your password. Use “Lost password” feature.
Hi Babynus,
unfortunately I discover something strange:
Case:
We have several projects in parallel in projector. Once I entited a project lead for any of the projects, he is able to change all resouces, not only resources assigned (affected) to project. So he is able to change his profile from "project lead" to "adminstrator" or he is able to delete the Administor.
Suggested solution:
A project lead must not be able to
1. set/change a profile to a higher level than project lead.
2. set/change a profile which is higher level than project lead; except assignment to his project.
3. delete a resource with is not only assigned to his project.
4. assign a resource to any project out of the projects he is assigned.
Klaus
Hi Klaus,
You pointed out a real security issue.
Investigating ...
Babynus.
Hi,
Resource and Contact screens have been adapted :
- "profile" and "is user" can only be changed by user granted to manage users (by default only admin).
- item can only be deleted by user granted to manage users (by default only admin)
This way :
- project leader cannot change profile of any resource (because it is the user profile)
- project leader cannot add or remove a user
Concerning Affectation, project leader can only manage affectations of resources to his own project.
It has always been implemented this way.
Regards.
Babynus.
Hello Babynus,
perfect!
Klaus