zikula/core — Issue #167: incoherent permissions in Users_Controller_Admin
Author: tfotis
Created: 2011-11-18 12:17:37+00:00
State: open

When a user has ACCESS_ADD rights on the Users module, he is supposed to be able to create a new user.

You can clearly see this here https://github.com/zikula/core/blob/release-1.3/src/system/Users/lib/Users/Api/Admin.php#L353 and here https://github.com/zikula/core/blob/release-1.3/src/system/Users/lib/Users/Controller/Admin.php#L230.

But in the Admin controller there is a permission check for ACCESS_ADMIN (see here https://github.com/zikula/core/blob/release-1.3/src/system/Users/lib/Users/Controller/Admin.php#L234)

So ACCESS_ADMIN should be changed to ACCESS_ADD.