If a user A and a user B are both super user and the user A removes the super user permission of the user B, and the user B is logged in, while the user B session remain active, he can do anything on the system including recover his super user permission.


Looking at the JUser::authorise method, we can see something like this:

public function authorise($action, $assetname = null)
    // Make sure we only check for core.admin once during the run.
    if ($this->isRoot === null)
        //check if the user is root

    return $this->isRoot ? true : JAccess::check($this->id, $action, $assetname);

So, if the user get logged in as super user, the JUser object in the session will have the isRoot property as true and the authorise method will always return true without check the current permission in database.

OBS: JFactory:getUser() return the JUser in session

  • If I rightly remember, I tried something like this. I removed the super user permissions from user B whilst they were in the backend, then refresh the page and they were not able to access the backend.
    – Lodder
    Commented Jul 8, 2014 at 13:37
  • what version did you try? In the version 3.3.1 I did the same test as you and the user B remains able to access the backend after refresh.
    – csbenjamin
    Commented Jul 8, 2014 at 13:42
  • I think it was Joomla 2.5.22. I will have another test again later on and let you know. Will be sure to test 3.3.1 this time though
    – Lodder
    Commented Jul 8, 2014 at 13:43
  • @Lodder Take a look at my edit above
    – csbenjamin
    Commented Jul 8, 2014 at 13:54

1 Answer 1


Imho the only way would be to delete the session in the database (#__session table).

Then the user is forced to log in again and the permissions are calculated fresh.

UPDATE: As the comment below, there is no "joomla way" to destroy the session if we are using JSessionStorageNone. So, you likely have to wait till that users session times out or he logs out himself.

  • It works if we are using JSessionStorageDatabase. If we are using JSessionStorageNone, this wont force the user to log in again.
    – csbenjamin
    Commented Jul 8, 2014 at 16:17
  • True. Then you likely have to wait till that users session times out or he logs out himself.
    – Bakual
    Commented Jul 8, 2014 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.