Panel: Do not allow a subuser to assign permsions they don't have

[mkcoldwolf]

Is your feature request related to a problem? Please describe.
Yes, as you are in subuser system, a user can assign perms that he doesn't have themself
when he has a permission to edit and list subuser
So, if i give any subuser a edit user perm, then the whole subuser system is useless sinces they get gain all perm by giving other perm that he doesn't have, idk you guys still think its how it works? 🤔

Describe the solution you'd like
Show Insufficient Permission or somethings like that when they trying to give other subuser permission that he dont have himself

Describe alternatives you've considered
no, not yet without remove their edit subuser permermission

Additional context

[HavilahOG]

It doesn't make the sub system useless because you giving a sub-user permission to edit other sub-user's permissions should do exactly that.

Server owner can give a co-owner/friend the permission so they can both manage other sub-users freely
I think it's kind of obvious how the permission is useful but you're adamant on it calling it useless for some weird reason.

[mkcoldwolf]

It doesn't make the sub system useless because you giving a sub-user permission to edit other sub-user's permissions should do exactly that.

Server owner can give a co-owner/friend the permission so they can both manage other sub-users freely
I think it's kind of obvious how the permission is useful but you're adamant on it calling it useless for some weird reason.

no but then they are not even co-owner or no longer a "Subuser", the are just same as owner now then why dont i just give owner permission to him instead of giving him "Subuser"?

EDIT:
Opss clicked wrong the close issue button...

[HavilahOG]

no but then they are not even co-owner or no longer a "Subuser", the are just same as owner now

Isn't that what a co-owner of a server is? same as owner lol

then why dont i just give owner permission to him instead of giving him "Subuser"

It's not possible to set 2 users as owner of a single server?

[mkcoldwolf]

Isn't that what a co-owner of a server is? same as owner lol

emm, maybe your right, but that features is also needed i think,
such as admin for certain server or somethings

It's not possible to set 2 users as owner of a single server?

Yea so that match the scenario that Zexceil created

[Yomanz]

I honestly think the bigger question here is, why would you give someone just edit subuser permission.
(And even more specifically, why would you add an "_untrustworthy_" subuser to your server)

[mkcoldwolf]

I honestly think the bigger question here is, why would you give someone just edit subuser permission.

So as i said, there is actually somethings like admin but not co-owner at certain server... i cant give them panel admin or even all permission in one server, but i need them to manage ppl within his power

(And even more specifically, why would you add an "_untrustworthy_" subuser to your server)

so ur server doesn't have any 'untrustworthy' admins? ......
i thought no one is trustable in internet though...

[HavilahOG]

Think of this feature at the level of being just a server owner who doesn't own the panel

[Yomanz]

so ur server doesn't have any 'untrustworthy' admins? ......

What a stupid reply.

So as i said, there is actually somethings like admin but not co-owner at certain server.

Why would you give your admins access to the panel apart from starting and stopping

[parkervcp]

I needed to fix that. I really did.

[mkcoldwolf]

i would suggest keeping those two feature, one option that can assign out of his power and one option for only within his power

[DaneEveritt]

This makes significantly more sense using @parkervcp's title. In the future if you wish to be taken seriously please provide coherent thoughts and solutions, not sentences just strung together complaining about something.

[mkcoldwolf]

This makes significantly more sense using @parkervcp's title. In the future if you wish to be taken seriously please provide coherent thoughts and solutions, not sentences just strung together complaining about something.

im sorry about that, will try my best next time, since im not a eng, i may not able to explain what i wanted to say exactly

[DaneEveritt]

For example: the subuser system allows someone with the 'Edit Subusers' permission to assign permissions that they do not have to a different user. I think they should only be allowed to assign permissions that they have already.

[MatthewSH]

Looking further in into this issue, it's not even checking the user at all to see if the user has any of the requested permissions. You could make a check when setting each user permission with an alllowedPermissions array that doesn't allow create-subuser unless you're the owner of the server. The allowedPermissions can just be a copy of the current user permissions without the create-subuser one (or null for all permissions). If that makes sense.

[DaneEveritt]

A subuser should be allowed to create a subuser with the same permissions they have, but not additional ones. I'm not going to fiddle around with any of this for now though because I don't like the current permissions that we have, they're excessively granular which makes changing features/adding new ones painful.

[DaneEveritt]

Closed in 1.0.0.