Jump to content
  • Checkout
  • Login
  • Get in touch

osCommerce

The e-commerce.

[CONTRIB] Admin Access Level Accounts for MS2


papasan

Recommended Posts

I'm getting this error message with this contrib when accessing index.php for the admin section:

 

1146 - Table 'database_ms2.TABLE_ADMIN_FILES' doesn't exist

 

select admin_files_id from TABLE_ADMIN_FILES where FIND_IN_SET( '', admin_groups_id) and admin_files_is_boxes = '1' and admin_files_name = 'configuration.php'

Not sure what I did wrong, otherwise I've made the four changes mentioned above.

Link to comment
Share on other sites

a regular login is not singular and it is more security prone to hackers. yeah I know hackers don't go in that way anymore....

but you can just change the login/create account functions to not look at email addy's for login names.

(my knowledge is so small you would think that an ant was a genius in comparison)

Link to comment
Share on other sites

I hope I ask this correctly...

 

The Top Level Admin can of course create Administrators and assign them "tasks" or "areas that they can see". Put another way, we already know that creating an Administrator that has some boxes NOT checked prevents them from seeing those sections/admin pages.

 

Is it possible to create an Admin, that can create "SubAdmins", but [and here's my question!] that the "Admin" cannot see ALL the sections of "oscommerce admin"?

 

Rats, I read that and I know it sounds confusing...

Say I want to create an Admin that is in charge of entering ALL the Product Data. I don't want them to mess around with all my Zones, and Store Configuration, etc, so of course I don't check Configuration boxes, or Modules boxes and so on. I create an Admin account called "ProductEntry". Now, I want that Admin to be able to create Admins (to be able to see the oscommerce admin Administrators mod, but I do NOT want that Admin to see all the OTHER oscommerce admin Menu Items such as Configuration, Modules, Reports and so on, remember?

 

Trouble is, if I give the Admin access to "Administrators" Menu item, couldn't they then see all the other sections of the oscommerce admin area?? I don't want to be the only one who can create Admins here... [me, the TopLevelAdmin, that is...].

 

Ian

Link to comment
Share on other sites

I am the To Level Admin.

 

I create an Account called ProductEntry001.

I create a Group called ProductEntry.

I give the group ProductEntry admin access to only the menu items "Category."

I add ProductEntry001 to the group called ProductEntry and call him up on the telephone to tell him he can get into the store now. I tell him to set up accounts for all the employees in his department and allow the to get to work creating products and categories. But I NEVER want him to see the other parts of the store [in the osCommerce admin that is], I only want him to see stuff INSIDE of the Categories section. Same applies to all the employees in his department.

 

Currently, to do this, I either have to create these other accounts FOR him [because I'm the Top Level Admin] OR I have to give ProductEntry001 access to the Administrators module, whereupon against my wishes, he's be able to give himself more privileges and see stuff I don't want him seeing.

 

How do I allow an Admin to create SubAdmins (and assign them permissions) within his/her group without giving him/her permission to edit group permissions "outside of" the group that Admin belongs to?

 

I do not want to be the only one who can assign new admins with permissions [me, the Top Level Admin, that is...]. But I don't want my subordinates looking around in the other parts of oscommerce admin either...

 

Help?

Link to comment
Share on other sites

Hi All,

 

I've recently installed this on an MS2 store build and all seems to be working well.

 

However, IIRC in the older versions of this contrib there was a means to edit the permissions of each user. With this version I can create new admins and delete them, but seemingly have no way to edit their permissions once their account has been created.

 

Can anyone tell me if this is by design, or have I missed something in the install?

 

Cheers,

 

 

 

Mark

Link to comment
Share on other sites

Equilla,

 

In this Contribution, you do not edit the permissions of a user, you edit the permissions of a Group. You add one or more users to a Group.

 

You seem to have already solved creating new users. Once you solve how to create a new Group, you will find there the button called Permissions. Clicking Permissions will allow you to set the permissions of that Group.

 

Then, go back to the Users/Accounts of Administrator and Edit one. You set that Account to be a member of a Group. Voila, that User has only the permissions of the Group you set them to.

 

Ian Sears

[email protected]

Link to comment
Share on other sites

hi.. i installed the contribution without problems.. i also manage some other boxes to work with the contrib.. but i have a really big problem, how can i setup the other users passwords??

 

i create groups, create users, in the db each user has a password (encrypted), but i can't figure out how to see it without the encryption...

 

does this contribution send an email to the user?

 

cheers

emiliano

 

pd: my english it's getting worse everysecond

patagonia, argentina

Link to comment
Share on other sites

I found one more little annoyance.

 

If you grant access to a category of functions, and then don't grant access to the first file in that category, you get a permission error when you select the category.

 

Example:

 

Give access to the Tools menu item, but not the Backup option - only Send Email and Newsletter Manager. If you log in as that user now and go to the Tools selection then, you will get an access violation that is not clear to the end user what he is trying to do that he's not permitted access to do.

 

The Tools select "pulls up" the backup option by default, and since the user does not have access to backup, he gets the Forbidden message...

-t

Link to comment
Share on other sites

Is it possible to create an Admin, that can create "SubAdmins", but [and here's my question!] that the "Admin" cannot see ALL the sections of "oscommerce admin"?

 

as far as i know this is not a possibility with the current admin package. i don't plan on adding any functionality to the package, i just ported it over to 2.2 and tried to clean the code up a little. have at it =).

Link to comment
Share on other sites

I just installed this on a site I am putting together and it is excellent, but I do have one question and that is, how safe is this? How secure is my admin with this mod installed and should I also employ some other security measures? I am not using a ssl server incidently.

Link to comment
Share on other sites

I don't know if this has been mentioned yet but I am having trouble getting 2 files to be accessible. The first is a popup page accessible via the banners box it is popup_image.php and the second is another mod I have for live support. ls_start.php I need to know how I can add these to be accessible since they arent part of the box system.

Link to comment
Share on other sites

I fixed it by editing /admin/banner_manager.php

 

I changed

<td class="dataTableContent"><?php echo '<a href="java script:popupImageWindow('' . FILENAME_POPUP_IMAGE . '?banner=' . $banners['banners_id'] . '')">' . tep_image(DIR_WS_IMAGES . 'icon_popup.gif', 'View Banner') . '</a> ' . $banners['banners_title']; ?></td>

 

to

 

<td class="dataTableContent"><?php echo '<a href="java script:popupImageWindow('' . FILENAME_POPUP_IMAGE . '?banner=' . $banners['banners_id'] . '&' . SID . '')">' . tep_image(DIR_WS_IMAGES . 'icon_popup.gif', 'View Banner') . '</a> ' . $banners['banners_title']; ?></td>

Link to comment
Share on other sites

If I add a section of my admin to my favourite/Bookmarks of my web browser - example:

 

http://www.myweb.com/admin/whos_online.php

 

to save me time click links ect.. I want to go directly to that page. admin/whos_online.php

 

but now with Admin Level installed, the links dont go to that the paticular page, once you hit the login screen, and login the page always brings up admin/index.php..

 

this is a small problem with me as the emails I recieve for orders have direct links for me "admin" to the customers order.. so I can edit or print invoices --fast-- no link clicking/order searching upon login ect...

 

does anyone know away around this, so if I typed: http://www.myweb.com/admin/whos_online.php in my browser, once succefully loging into the admin section it will go directly to the page I requested rather then /index.php (then have to click my way to the page).

 

Cheers MaxiDVD :lol:

Link to comment
Share on other sites

papasan,

 

Have you considered a way to restrict Admin accounts to a reduced set of Admin Menu options, while still giving them authority to create "subadmin" accounts to help them manage the store?

 

Ex.

Top Level Admin sees whole store.

Creates a group called Admins and restricts their permissions to ONLY entering in Product.

Creates an Admin001 to run this area.

Admin001 logs into osC Admin.

Admin cannot create SubAdmins without being given access to the osC Admin "Administrators menu.

But this allows him to edit and increase his own Permissions! Not good.

 

Help?

 

Ian

Link to comment
Share on other sites

Hey Everybody

 

When useing the search field in the admin section there are a small bug

 

Try to put in a search query in the search field and push enter !!

Then you will be logged out !!

 

How can we solve this problem ??

 

Regards Cypherdenmark

 

Is there noby who can help on this bug.

 

When useing a search field in the admin secion or the goto field it will log me out to (goes to login.php), it concerns every search form/goto form in the admin section....

Link to comment
Share on other sites

When useing a search field in the admin secion or the goto field it will log me out to (goes to login.php), it concerns every search form/goto form in the admin section....

 

I do not get this bug either, not sure what to tell you. perhaps you are waiting too long to do a search? sessions expire in 20-30 minutes or something like that.

Link to comment
Share on other sites

Have you considered a way to restrict Admin accounts to a reduced set of Admin Menu options, while still giving them authority to create "subadmin" accounts to help them manage the store?

 

Is it possible to create an Admin, that can create "SubAdmins", but [and here's my question!] that the "Admin" cannot see ALL the sections of "oscommerce admin"?

as far as i know this is not a possibility with the current admin package. i don't plan on adding any functionality to the package, i just ported it over to 2.2 and tried to clean the code up a little. have at it =).

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...