I've updated 2 seperate installations of DNN5.x to DNN5.6.  I have users which have edit rights to modules, since the upgrade these users seem to have full admin access to the module?

They can not only move the module around, but also get into the settings and change the security to allow anyone to mess up the site??

This is a very large security bug!...I surprised it's not been reported before?...Has anyone else noticed this or is it something just my sites that have this problem??

I've not investigated what the problem could be, but I'm looking into it now! 

Regards,
Dave.

Hi Seb,

I'm sure, the users only have edit rights to the modules.

In fact I've just done a fresh installation and I'm getting the same problem??

1 - new installation of DNN5.6 (using AUTO install)
2 - creatred a new super user
3 - logged in as new super user
4 - Gave the top text/html Registered User Edit rights.
5 - created a new users.
6 - logged in as new user.  - New user can now access the settings of the top modules and change security of that module as he wishes!!...other modules on page can;t be accessed?

I find it difficult to believe this slipped passed testing??...even though I myself feel a prize fool for not seeing it when I tested 5.6 before I upgraded, I just  assumed user security would stay the same??

Is this a bug? or do you know if I'm missing something??..Must say I've not checked gemini yet ...I'll do that now.


Dave.

great, thanks!

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN