[not a bug] sub account - modify contacts / master profile issue

[Revolution]

Not sure if anyone else is seeing this, but when a sub account is activated and the "modify master profile" is unchecked but "view and manage contacts" is checked, the sub account user can still modify the master profile. Because that sub account user can go into their own settings and check "modify master profile".

Edited July 17, 2015 by Revolution

[WHMCS Nate]

Hello,

 

This is an interesting case to discuss. At some level the fact that a contact with manage contacts can manage their contact makes sense. At another level if you want to have a subcontact without some permissions but that can manage other contacts, you would need to give them this permission without giving them much else.

 

I have opened case CORE-8762 to track our development team's conversation about this. I will update this thread with the results of our discussion.

 

Have a great day,

 

Nate C

[WHMCS Nate]

Hello,

 

We have discussed this internally and do not think its something we can solve at this time. Even if we were made it so that you can't edit your own sub-account, you would still be able to create a new sub account and give that user master profile perms, then login as them and make changes. Fundamentally the modify contacts permission is something that should only be given to users you trust.

 

We would like to implement a more robust sub-contact permission / role based workflow, but that would involve a major rewrite of how we handle sub-contacts and is beyond the scope of a bug report that the Release Team can handle.

 

Have a great day,

 

Nate C