2

If a user A and a user B are both super user and the user A removes the super user permission of the user B, and the user B is logged in, while the user B session remain active, he can do anything on the system including recover his super user permission.

Update

Looking at the JUser::authorise method, we can see something like this:

public function authorise($action, $assetname = null)
{
    // Make sure we only check for core.admin once during the run.
    if ($this->isRoot === null)
    {
        //check if the user is root
    }

    return $this->isRoot ? true : JAccess::check($this->id, $action, $assetname);
}

So, if the user get logged in as super user, the JUser object in the session will have the isRoot property as true and the authorise method will always return true without check the current permission in database.

OBS: JFactory:getUser() return the JUser in session

  • If I rightly remember, I tried something like this. I removed the super user permissions from user B whilst they were in the backend, then refresh the page and they were not able to access the backend. – Lodder Jul 8 '14 at 13:37
  • what version did you try? In the version 3.3.1 I did the same test as you and the user B remains able to access the backend after refresh. – csbenjamin Jul 8 '14 at 13:42
  • I think it was Joomla 2.5.22. I will have another test again later on and let you know. Will be sure to test 3.3.1 this time though – Lodder Jul 8 '14 at 13:43
  • @Lodder Take a look at my edit above – csbenjamin Jul 8 '14 at 13:54
1

Imho the only way would be to delete the session in the database (#__session table).

Then the user is forced to log in again and the permissions are calculated fresh.

UPDATE: As the comment below, there is no "joomla way" to destroy the session if we are using JSessionStorageNone. So, you likely have to wait till that users session times out or he logs out himself.

  • It works if we are using JSessionStorageDatabase. If we are using JSessionStorageNone, this wont force the user to log in again. – csbenjamin Jul 8 '14 at 16:17
  • True. Then you likely have to wait till that users session times out or he logs out himself. – Bakual Jul 8 '14 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.