I'm trying to set up a site (5.6.0) wherein a particular type of user ("Board Member") should be able to edit the content of various modules (Events, for example), but I don't want them to be able to delete modules or change the settings of modules.  These folks know just enough to be dangerous, and I'd really like it if they couldn't mess up the site and have to call me every 10 minutes.

So I created a Calendar page, and set it so that only Administrators have Edit Page access.  I added an Events module, inherited the View permissions, and set the "Board Member" role to have Edit Module access. 

The problem is, when I log in as a test board member, I can delete the module right off the page!  It seems more logical to me that only a Page Editor should be able to do that... Module Editors should be able to change the contents of a module, but not whether it exists or where it is on the page, and holy crap, they can change the security settings (role access and the like) too!  How do I prevent all that while still allowing Board Members to create and moderate events, which seems to require Module Editor status?

I've also tested with a few other modules (Newsletters comes to mind), and the same behavior applies.  This seems like a pretty freakin' huge security hole.

I can also confirm this issue in a clean install of 5.06.00 vs a clean install of 5.05.01. The user with edit permission on a module instance receives the same module action menu items (settings, import/export, move, delete) as an admin user or user with page edit permissions would receive.

---

Bill, WESNet Designs
Team Lead - DotNetNuke Gallery Module Project (Not Actively Being Developed)
Extensions Forge Projects . . .
Current: UserExport, ContentDeJour, ePrayer, DNN NewsTicker, By Invitation
Coming Soon: FRBO-For Rent By Owner

Tom, please make sure, your solution gets appended to the item in the issue tracker at support.dotnetnuke.com.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN