Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...User Accounts in DNN 7.02.02User Accounts in DNN 7.02.02
Previous
 
Next
New Post
3/24/2014 10:28 AM
 
Hello,

In DNN 7.02.02, is it possible for non-administrators to edit and authorize new user accounts? I have read in previous posts that DNN has considered including this functionality, but couldn’t find if it was ever implemented or not. I have tried adding the User Accounts module to a separate page and giving edit permissions to a non-administrator. However, the account receives a ‘You are not authorized to edit this user’ error when trying to edit or approve user accounts.

Thanks,
Evan

 
New Post
3/24/2014 1:18 PM
 
This functionality is not included in DNN Platform at this time.

Could you point me to the posts where you have seen this discussion?

Ken Grierson
DotNetNuke Corporation
Test Lead
 
New Post
3/24/2014 1:30 PM
 

And I must say that its really ridiculous that this doesn't exist in the DNN platform.  I have spent THOUSANDS of dollars building this capability in elsewhere (a custom member directory that does these things) just to allow a non-admin to add/delete manage users.  

You used to be able to do this pre DNN 5.6.x.  When we upgraded to 5.6.7 we lost the feature.  You could assign a role view permissions to the manage users module and it worked great.  Upgrading to 5.6.7 broke the connection. In fact when upgrading further users would have the ability to click the delete button to delete a user but it wouldn't work.  

 

 
New Post
3/24/2014 3:36 PM
 

Thanks for the info!

I don't believe there was ever an official confirmation that this functionality would be available but we were hopeful that it was going to be implemented based on these threads:

http://www.dnnsoftware.com/answers/vi...

http://www.dnnsoftware.com/forums/for...

 
New Post
3/24/2014 5:52 PM
 
Seth wrote:

And I must say that its really ridiculous that this doesn't exist in the DNN platform.  I have spent THOUSANDS of dollars building this capability in elsewhere (a custom member directory that does these things) just to allow a non-admin to add/delete manage users.  

You used to be able to do this pre DNN 5.6.x.  When we upgraded to 5.6.7 we lost the feature.  You could assign a role view permissions to the manage users module and it worked great.  Upgrading to 5.6.7 broke the connection. In fact when upgrading further users would have the ability to click the delete button to delete a user but it wouldn't work.  

 

 It's true you used to be able to do it in a few versions of DNN, but this was an accident and not an intended functionality. A serious security bug was reported to us at that time where there was the potential for a hacker to access some of the functions of those pages, at which point they could escalate their used to the administrator role and then pretty much do what they liked.

As such we correctly locked down the pages, so only admin/host's can do the actions - we did this at the page level and not the API level so that people could still write code to do admin level actions without being an admin if they wanted. We're sorry if you were relying on that functionality but security has to be the most important thing in cases such as this.

 

 


Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...User Accounts in DNN 7.02.02User Accounts in DNN 7.02.02


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out