we're aware of the issue and are investigating it. The faulty functionality has existed since the 1.0 days but as the concept of page/module editors didn't really exist then it wasn't a problem. However as these permissions can be granted to non-admin/host users, this does mean that these users can violate the security boundaries i.e. a user with permissions to one page should not be able to affect other pages.

Whilst it's arguably a usability issue (changing the default style to one from a list of pre-approved styles rather than injecting code), breaking out of a security sandbox is not a desirable behaviour. We'll look into this for the 6.0 release and will likely lock down various functions e.g. apply to all pages, set as default settings, apply to all modules and copy design to descendants. The easy (and quick) fix is to limit these functions to Admins, but we may look to add additional code to handle other cases (e.g. copy design to descendants could be active if the user has edit permissions to all descendant pages). Note: this will likely impact some use-cases and perhaps raise some enhancement requests (e.g. apply to all MY pages/apply to all MY modules etc.), but we'll only initially be looking at adding additional logic to stop users breaking the security sandbox.

Thanks,
Cathal

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

yes, of course, if it's a core problem it affects all versions (PE/EE use CE as a base and just add a few modules/providers/skins to it)

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US