COMMUNITY FORUM
Search Results (Searched for: k2 Tag)
- Krikor Boghossian
21 Mar 2018 23:25
Replied by Krikor Boghossian on topic Broblem with Image Alt Attributes
Broblem with Image Alt Attributes
Category: English K2 Community
- Daily Deals UK
19 Mar 2018 16:11
Replied by Daily Deals UK on topic Stop Google from indexing 'tag' pages when tags are used ?
Stop Google from indexing 'tag' pages when tags are used ?
Category: English K2 Community
- Krikor Boghossian
18 Mar 2018 11:53
Replied by Krikor Boghossian on topic Display tag pages same as category pages
Display tag pages same as category pages
Category: English K2 Community
- frederique cavalier
17 Mar 2018 17:53
Replied by frederique cavalier on topic Cards Twitter & Facebook Open Graph articles K2
Cards Twitter & Facebook Open Graph articles K2
Category: Communauté française K2
- Krikor Boghossian
14 Mar 2018 16:42
Replied by Krikor Boghossian on topic A little question about add custom tags
A little question about add custom tags
Category: English K2 Community
- myquyen1996
13 Mar 2018 04:17
A little question about add custom tags was created by myquyen1996
A little question about add custom tags
Category: English K2 Community
- Zed
12 Mar 2018 15:52
- James Argo
10 Mar 2018 07:21 - 10 Mar 2018 08:13
K2 Backend ACL critical problem, user can do restricted action. was created by James Argo
K2 Backend ACL critical problem, user can do restricted action.
Category: English K2 Community
Greeting all...
First of all, thank you Joomlaworks for providing us so useful and wonderful extension K2 for free. It is great!
Ok, I just have found a problem which could cause a threat to our site, where user with very limited backend admin access can see, and take action on things they suppose NOT to do. I spent last few days on testing this issue in both local server and also online server. I can confirm this is really potential problem which can destroy the whole K2 articles in our site. To make it short, let's make it this way:
1. Fresh install Joomla 3.8.5.
2. Fresh install K2.
3. No other extension installed.
4. I (as Super User) create Joomla usergroup Author, and new Viewing Access Level called "Author" which includes Public, Registered and Author only (ticked).
5. I create a Joomla user named "author1" which will act as article creator. In Joomla user, I assign this user author1 to usergroup Author. Then import the user to K2 user. His ONLY job is to create K2 articles and edit his OWN articles when necessary via back end and NOT to publish it. To do so, I assign his permission via Joomla ACL as follow :
If we do it correctly, we can now logout as Super User, and re-login to backend administrator as Author1 with limited view access.
What we see as Author1 in backend administrator Cpanel page is K2 stats (admin) , and K2 Quick Icons (admin) , while in toolbar he can see Components and Help menu. The Components will only have K2 sub menu, * with K2 FULL sub menu instead of only Items, category, tags, comments, media manager, and information! *
That means, using the toolbar this Author1 is able to access many unauthorized resources and take unauthorized action such as disabling any user available (despite their usergroup), and flag them as spammer!
It is true that when he tries to access (for example) the K2 Users page, he will be warned by red error box saying "Error you are not authorized to view this resource", but still the page is open and give him an access to many unauthorized option to take action such as disabling users, and flag users as spammers.
Ok, so what if I don't grant access of module toolbar to Author? Doesn't that mean he is still able to access K2 section via K2 Quick Icons (admin) menu in Cpanel when he logged in and NOT having full K2 menu in toolbar?
Yes... He will not see Component menu in toolbar. Thus he wont have any K2 submenu either. And he still be able to access K2 backend section through K2 Quick Icons (admin). The problem is, there is still a chance for him to easily "sneak" into the hole.
Let's say I don't grant access of module toolbar to Author in admin menu module. This author can access K2 backend section through K2 Quick Icons (admin). What he will see in the left menu are : Items, Categories, Tags, Comments, Media Manager, and Information only. No link to K2, Users, Usergroups, or Extra fields. The problem is, when he create new article (or editing his own) the K2 item editor will open. In this K2 item editor, he CAN change the author by clicking Author button... When he click it, K2 users page will open and again, he will be warned by red error box saying "Error you are not authorized to view this resource", but still the page is open and give him an access to many unauthorized option to take action such as disabling users, and flag users as spammers.
If you don't have any idea what was happening when someone click flag users as spammer to legit site contributors, it is big disaster. All their articles will be destroyed from database, and the user is deleted from K2 database table, the site turns out error 1056 database error etc in front end, etc... Well, at least that was what happen to me last week. The website down for a while. Lucky I got daily backup to restore (Thanks Akeeba!).
I am not sure if this is appropriate, but granting this user "Access Administration Interface" in global K2 permission ACL should not go that far. There should be a way where "Access Administration Interface" permission does not give him way to far access in K2 admin section. Instead, only permission given to him is accessible (like create items and edit his own).
The next thing is, he is able to publish his own article if he manage to edit his own article via backend admin K2 item editor. It is true, that if he goes to Items menu in K2, (where he will see list of articles), he can not click (un-tick) the published checkbox (doing so will not change the state of article) to make it published or unpublished. But if he manage to edit the articles, he is able to change the state of publishing via K2 item editor page (it will take effect after saving).
That's all for now, please bear my English. I hope JW developers can take a look into the problem and solve them in next release.
Thank you so much for all your effort! You guys ROCK!!
First of all, thank you Joomlaworks for providing us so useful and wonderful extension K2 for free. It is great!
Ok, I just have found a problem which could cause a threat to our site, where user with very limited backend admin access can see, and take action on things they suppose NOT to do. I spent last few days on testing this issue in both local server and also online server. I can confirm this is really potential problem which can destroy the whole K2 articles in our site. To make it short, let's make it this way:
1. Fresh install Joomla 3.8.5.
2. Fresh install K2.
3. No other extension installed.
4. I (as Super User) create Joomla usergroup Author, and new Viewing Access Level called "Author" which includes Public, Registered and Author only (ticked).
5. I create a Joomla user named "author1" which will act as article creator. In Joomla user, I assign this user author1 to usergroup Author. Then import the user to K2 user. His ONLY job is to create K2 articles and edit his OWN articles when necessary via back end and NOT to publish it. To do so, I assign his permission via Joomla ACL as follow :
- Joomla global ACL, set the group Author to have backend Administrator login. That's it. The rest permission in this point is inherited.
- Still in Global Configuration, go to K2 permission tab. Set Author permission to allow CREATE and EDIT OWN. *I also have to set Access Administration Interface" to Allowed, in order to make the admin menu toolbar appear to the author while he is login to backend administrator. Otherwise he will not be able to access either component toolbar or any K2 section (panel) in backend administrator.* Save it.
- Go to admin menu Joomla Extension --> Modules --> Administrator. FInd the module "Toolbar", edit it and grant access to "Author"
If we do it correctly, we can now logout as Super User, and re-login to backend administrator as Author1 with limited view access.
What we see as Author1 in backend administrator Cpanel page is K2 stats (admin) , and K2 Quick Icons (admin) , while in toolbar he can see Components and Help menu. The Components will only have K2 sub menu, * with K2 FULL sub menu instead of only Items, category, tags, comments, media manager, and information! *
That means, using the toolbar this Author1 is able to access many unauthorized resources and take unauthorized action such as disabling any user available (despite their usergroup), and flag them as spammer!
It is true that when he tries to access (for example) the K2 Users page, he will be warned by red error box saying "Error you are not authorized to view this resource", but still the page is open and give him an access to many unauthorized option to take action such as disabling users, and flag users as spammers.
Ok, so what if I don't grant access of module toolbar to Author? Doesn't that mean he is still able to access K2 section via K2 Quick Icons (admin) menu in Cpanel when he logged in and NOT having full K2 menu in toolbar?
Yes... He will not see Component menu in toolbar. Thus he wont have any K2 submenu either. And he still be able to access K2 backend section through K2 Quick Icons (admin). The problem is, there is still a chance for him to easily "sneak" into the hole.
Let's say I don't grant access of module toolbar to Author in admin menu module. This author can access K2 backend section through K2 Quick Icons (admin). What he will see in the left menu are : Items, Categories, Tags, Comments, Media Manager, and Information only. No link to K2, Users, Usergroups, or Extra fields. The problem is, when he create new article (or editing his own) the K2 item editor will open. In this K2 item editor, he CAN change the author by clicking Author button... When he click it, K2 users page will open and again, he will be warned by red error box saying "Error you are not authorized to view this resource", but still the page is open and give him an access to many unauthorized option to take action such as disabling users, and flag users as spammers.
If you don't have any idea what was happening when someone click flag users as spammer to legit site contributors, it is big disaster. All their articles will be destroyed from database, and the user is deleted from K2 database table, the site turns out error 1056 database error etc in front end, etc... Well, at least that was what happen to me last week. The website down for a while. Lucky I got daily backup to restore (Thanks Akeeba!).
I am not sure if this is appropriate, but granting this user "Access Administration Interface" in global K2 permission ACL should not go that far. There should be a way where "Access Administration Interface" permission does not give him way to far access in K2 admin section. Instead, only permission given to him is accessible (like create items and edit his own).
The next thing is, he is able to publish his own article if he manage to edit his own article via backend admin K2 item editor. It is true, that if he goes to Items menu in K2, (where he will see list of articles), he can not click (un-tick) the published checkbox (doing so will not change the state of article) to make it published or unpublished. But if he manage to edit the articles, he is able to change the state of publishing via K2 item editor page (it will take effect after saving).
That's all for now, please bear my English. I hope JW developers can take a look into the problem and solve them in next release.
Thank you so much for all your effort! You guys ROCK!!
- Krikor Boghossian
08 Mar 2018 23:36
Replied by Krikor Boghossian on topic K2 tag redirects to another menu
K2 tag redirects to another menu
Category: English K2 Community
- George Nasis
08 Mar 2018 14:02
Replied by George Nasis on topic K2 tag redirects to another menu
K2 tag redirects to another menu
Category: English K2 Community
- George Nasis
08 Mar 2018 13:57
K2 tag redirects to another menu was created by George Nasis
K2 tag redirects to another menu
Category: English K2 Community
- Timothy Michel
04 Mar 2018 18:47
Replied by Timothy Michel on topic K2 and Joomla Page Break Elements
K2 and Joomla Page Break Elements
Category: English K2 Community
- SweetElite
03 Mar 2018 16:19 - 04 Mar 2018 12:10
But its not working ,
If anyone could help me out thanks in advance..
Here is the link on my site with my K2 stories see what i mean..
fishinaddicts.com/fishing-blogs
Thanks
share button was created by SweetElite
share button
Category: English K2 Community
But its not working ,
If anyone could help me out thanks in advance..
Here is the link on my site with my K2 stories see what i mean..
fishinaddicts.com/fishing-blogs
Thanks
- STEPHAN HERBY
02 Mar 2018 17:14 - 02 Mar 2018 17:15
Replied by STEPHAN HERBY on topic Twitter card & Facebook Open Graph to K2 articles
Twitter card & Facebook Open Graph to K2 articles
Category: English K2 Community
- Eric Lamy
01 Mar 2018 09:49
Replied by Eric Lamy on topic Impossible to publish on frontend (file not found)
Impossible to publish on frontend (file not found)
Category: English K2 Community
- STEPHAN HERBY
28 Feb 2018 17:46
Need help for conditionnal tag display was created by STEPHAN HERBY
Need help for conditionnal tag display
Category: English K2 Community
- STEPHAN HERBY
28 Feb 2018 17:28 - 28 Feb 2018 17:31
Replied by STEPHAN HERBY on topic Twitter card & Facebook Open Graph to K2 articles
Twitter card & Facebook Open Graph to K2 articles
Category: English K2 Community
- Robert
21 Feb 2018 18:51
Cards Twitter & Facebook Open Graph articles K2 was created by Robert
Cards Twitter & Facebook Open Graph articles K2
Category: Communauté française K2
- Krikor Boghossian
12 Feb 2018 22:57
Replied by Krikor Boghossian on topic remove component/k2/ from tag url
remove component/k2/ from tag url
Category: English K2 Community
- Krikor Boghossian
12 Feb 2018 22:53
Replied by Krikor Boghossian on topic Merge k2 tags with different syntax but same content
Merge k2 tags with different syntax but same content
Category: English K2 Community