{"action":"created","issue":{"url":"https://api.github.com/repos/inverse-inc/packetfence/issues/1474","repository_url":"https://api.github.com/repos/inverse-inc/packetfence","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/1474/labels{/name}","comments_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/1474/comments","events_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/1474/events","html_url":"https://github.com/inverse-inc/packetfence/issues/1474","id":154658503,"number":1474,"title":"User actions 'usermanager' allows user to obtain ADMIN priviledges","user":{"login":"apkt","id":19342293,"avatar_url":"https://avatars.githubusercontent.com/u/19342293?v=3","gravatar_id":"","url":"https://api.github.com/users/apkt","html_url":"https://github.com/apkt","followers_url":"https://api.github.com/users/apkt/followers","following_url":"https://api.github.com/users/apkt/following{/other_user}","gists_url":"https://api.github.com/users/apkt/gists{/gist_id}","starred_url":"https://api.github.com/users/apkt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apkt/subscriptions","organizations_url":"https://api.github.com/users/apkt/orgs","repos_url":"https://api.github.com/users/apkt/repos","events_url":"https://api.github.com/users/apkt/events{/privacy}","received_events_url":"https://api.github.com/users/apkt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/inverse-inc/packetfence/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-05-13T08:24:19Z","updated_at":"2016-07-04T14:14:46Z","closed_at":null,"body":"A local user created in PF 6.0.1 that is granted 'usermanager' permissions is, quite rightly, not able to grant 'ALL' priviledge to other user accounts but it is still able to modify the ADMIN account in such a way as to obtain admin priviledges (Change the admin account password!!!!).\r\nThe 'usermanager' role action needs to be tightened so that it can be used only to manage local dynamically created users and not the system accounts ADMIN and DEFAULT.\r\nPerhaps some sort of hierarchy needs to be established (Privilege levels) so that an individual account cannot be used to modify a more privileged account."},"comment":{"url":"https://api.github.com/repos/inverse-inc/packetfence/issues/comments/230300143","html_url":"https://github.com/inverse-inc/packetfence/issues/1474#issuecomment-230300143","issue_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/1474","id":230300143,"user":{"login":"julsemaan","id":3857942,"avatar_url":"https://avatars.githubusercontent.com/u/3857942?v=3","gravatar_id":"","url":"https://api.github.com/users/julsemaan","html_url":"https://github.com/julsemaan","followers_url":"https://api.github.com/users/julsemaan/followers","following_url":"https://api.github.com/users/julsemaan/following{/other_user}","gists_url":"https://api.github.com/users/julsemaan/gists{/gist_id}","starred_url":"https://api.github.com/users/julsemaan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julsemaan/subscriptions","organizations_url":"https://api.github.com/users/julsemaan/orgs","repos_url":"https://api.github.com/users/julsemaan/repos","events_url":"https://api.github.com/users/julsemaan/events{/privacy}","received_events_url":"https://api.github.com/users/julsemaan/received_events","type":"User","site_admin":false},"created_at":"2016-07-04T14:14:46Z","updated_at":"2016-07-04T14:14:46Z","body":"This is a fairly large issue that will require a few hours of dev to do this cleanly.\r\n\r\nTo my knowledge, it isn't part of our priority list.\r\n\r\nBest way to prioritize this would be to sponsor the feature through the Inverse support"}}
{"actor":{"display_login":"julsemaan"}}