johnnyq
5d9b48e83e
Roles stage 2: refusals now say why, naming the role and what it lacks, as a Not for your role card in place of a page with the layout and Back, inside the window for a window, back on the page with a message for a handler or Admin, and as a 403 JSON error from ajax.php, no longer leaving a stale not permitted message on the next page; actions a role can't do are no longer offered, covering the clients bulk menu at Read keeping Send Email, asset bulk tools and ticks at Read, asset bulk Delete below Full, editing an asset's recurring tickets at Read, report links for roles without that report with the dashboard Profit card opening Transactions instead, Credentials in All Client Docs, a contact's Assets, Documents, Files and Services tabs and a document's linked records for roles without Support, shared-link notifications for roles without Support, and the client delete window only included where Delete Client is offered; role window warns when modules are given with Clients at None; user quick look shows what the agent can open from their role and the user form shows the picked role's access; changelog updated
2026-10-17 20:44:50 -04:00
..
Roles stage 1: Admin > Roles rebuilt showing each role's access per module as level-colored pills or Admin - everything, its agents with a link to Users filtered by role, search, Current and Archived tabs, and Edit, Copy, Archive, Restore and Delete greyed out with the reason when blocked; one role window for New, Edit and Copy with an Admin switch and a None, Read, Modify or Full level per module, each level listing what it allows, Reports limited to None and Read, and a copy dropping the Built-in description prefix; hardcoded role 3 checks replaced by guards so admin can't be taken off your own role or the only admins' role, archive needs no active agents, delete needs no agents at all, and names are unique in any case with the description optional; Administrator role can now be opened and renamed; role names escaped in flash messages, fixing an XSS; audit log records what changed on a role; lookupUserPermission reads the role's levels once per request instead of one query per check; new functions/roles.php, shared role_form.php and js/role_form.js; database 3.1.6 removes orphaned and duplicate user_role_permissions rows, clamps levels to 3 and adds a primary key on role and module; changelog updated
2026-10-17 20:43:45 -04:00
Roles stage 1: Admin > Roles rebuilt showing each role's access per module as level-colored pills or Admin - everything, its agents with a link to Users filtered by role, search, Current and Archived tabs, and Edit, Copy, Archive, Restore and Delete greyed out with the reason when blocked; one role window for New, Edit and Copy with an Admin switch and a None, Read, Modify or Full level per module, each level listing what it allows, Reports limited to None and Read, and a copy dropping the Built-in description prefix; hardcoded role 3 checks replaced by guards so admin can't be taken off your own role or the only admins' role, archive needs no active agents, delete needs no agents at all, and names are unique in any case with the description optional; Administrator role can now be opened and renamed; role names escaped in flash messages, fixing an XSS; audit log records what changed on a role; lookupUserPermission reads the role's levels once per request instead of one query per check; new functions/roles.php, shared role_form.php and js/role_form.js; database 3.1.6 removes orphaned and duplicate user_role_permissions rows, clamps levels to 3 and adds a primary key on role and module; changelog updated
2026-10-17 20:43:45 -04:00
Roles stage 2: refusals now say why, naming the role and what it lacks, as a Not for your role card in place of a page with the layout and Back, inside the window for a window, back on the page with a message for a handler or Admin, and as a 403 JSON error from ajax.php, no longer leaving a stale not permitted message on the next page; actions a role can't do are no longer offered, covering the clients bulk menu at Read keeping Send Email, asset bulk tools and ticks at Read, asset bulk Delete below Full, editing an asset's recurring tickets at Read, report links for roles without that report with the dashboard Profit card opening Transactions instead, Credentials in All Client Docs, a contact's Assets, Documents, Files and Services tabs and a document's linked records for roles without Support, shared-link notifications for roles without Support, and the client delete window only included where Delete Client is offered; role window warns when modules are given with Clients at None; user quick look shows what the agent can open from their role and the user form shows the picked role's access; changelog updated
2026-10-17 20:44:50 -04:00