Purge users should define its own permissions

Created on 20 May 2022, over 2 years ago
Updated 9 May 2023, over 1 year ago

Problem/Motivation

the routes are accessible by users with 'administer users' permissions, this is to wide of a permission, and is a security issue if not managed properly.

Steps to reproduce

create user with 'administer users', visit /admin/people/purge-rule

Proposed resolution

create own permissions for both routes, change routes access

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Fixed

Version

3.0

Component

Code

Created by

🇷🇴Romania Andras_Szilagyi

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024