Openrct2: Set Group Permissions - In-Game Security Risk

[Trippeh]

Hello,

groups.zip
Please have a look inside this groups.json and tell me if the following is normal:

Is it the intention that people with the group Moderator (who have the set group perm to promote lower grouped members) are able to set their own group to Admin? and then while being admin have a lot more perms to mess around with?

[Trippeh]

Or even others to Moderator being a Moderator themself.. this should not be the case in either case.

[IntelOrca]

Well moderator and admin are just simply group names, the game doesn't know whether a group is higher or lower than another. We could prevent it from changing ones own group, simple enough but they could still lower the privileges of other moderators.

[Margen67]

They have IDs, though.
You could make it so the game checks if the user's group id is lower (normally higher rank group) or equal to their current group.

But it wouldn't always work because the groups would have to be sorted in a specific way, and on top of that you couldn't easily reorganize the groups to fix it.

[Trippeh]

well having that added that they cant change their own would be good enough for now I guess, but would like to see a fix for both cases rather then just the one. But thanks if this can be done.

What Margen said is correct and also what you can see in the groups file.

In addition to this I can only suggest a group sorting function (move up n down) in-game,
where as it would be normal to have:
(This is also the default layout of your groups file after initial start up of a server:)

(0) Host
(1) Admin
(2) Moderator
(3) Full Perm Builder
(4) Semi Perm Builder
(5) etc
(6) etc

So it could be enforced to have it check whether the group ID being applied is lower than this own group ID, than stop him from doing so.
Also when he tries to change someone else's group ID who has the same group id as his own stop him from performing the action.

[Ryder17z]

The above I agree with

[Trippeh]

I'd like to see this implemented.
These are well worth it and pretty simple fixes compared to what you guys are doing on a daily basis.

[wolfreak99]

As far as organizing and moving goes.. i have a pr up for the idea of moving groups up / down, but it's still in an experimental state. people are complaining that it would clutter up the ui so it's kinda in limbo until i or someone else can come up with a better idea of how to show the buttons in... i would add a "right click" / context menu to show remove, move up, move down, duplicate, etc, but the current dropdown implementation only allows for one dropdown at a time.

[Trippeh]

Can't you have it show "up n down" next to the rank name in the drop down?