is possible that an Admin user can upload skin?
Obviously NO in the v.5 but, is a workaround that you now?
I doesen't want update a host user, but i what that and amin can change their skin

thank
rmartin

Rino
I am also looking at ways to provide Admin users the ability to upload skin/container packages.  

Since the change preventing Admin users this functionality I am seeing a lot more site owners give out Host/Super User accounts just so their designers can upload the skin packages as its a usability issue.  This in itself defeats the reason for the change and IMO creates a bigger security nightmare.

My idea is for a module that provides the ability to upload a package whilst checking it for security issues. This way a site admin can provide a non admin user the functionality whilst not even providing them site admin rights.  This Granular control is much better than the current approach.

To develop such a module will cost would you be interested in contributing?

Antony

The module functionality would have security implications.  But it would be up to the Host to consider these and control who has access to the module.

The following are my current thoughts on functionality:

The solution I believe is a module that can be deployed by site administrators allowing users in roles administrators provide View permissions to, to upload skin/container packages that are checked for safety and can only be installed in the current portal.  The module should accept the types of skin packages that the current core module does (i.e html, ascx).  Ideally the module should be compatable with DotNetNuke versions 4.9.5 and up.

The difficult part is determining what is ‘safe’ as this will vary from site owner to site owner. Therefore, the module will have to provide the ability to provide a range of options which can only be configured on an install level by a Host user. Probably through another module only available to Host users.

The ‘safety’ configuration process would interrogate the current install for extensions and menu providers that can be used in skins uploaded through the upload module and present them as items to allow.  It would also provide the option to allow some of the functionality built into ASP.Net working in a way that if it’s not specifically allowed its excluded.  The super user selects which items they want to allow and saves the settings (using RegEx?).