You've already forked Arcturus-Morningstar-Extended
mirror of
https://github.com/duckietm/Arcturus-Morningstar-Extended.git
synced 2026-06-19 15:06:19 +00:00
simoleo89
67d2f52f64
The default permission_definitions seed for acc_supporttool used the
pattern (0, 1, 1, 1, 1, 0, 1) across rank_1..rank_7 — apparently
shifted by two columns:
* rank_2 (VIP) and rank_3 (X) had ALLOWED. With acc_supporttool=1
the SecureLoginEvent path sends ModeratorInitMessageEvent on
login, which makes the React client surface the ModTools toolbar
button and let the user open room/user info windows. The actual
sanction endpoints (ModToolSanctionBanEvent, ModToolWarnEvent,
…) still gate on ACC_SUPPORTTOOL so a VIP cannot actually take
moderator action — but they can request user info, room info
and chatlogs they have no business reading.
* rank_6 (Super Mod) was DISALLOWED, which is obviously not what
the name says.
Corrected pattern: (0, 0, 0, 1, 1, 1, 1) — Support (4), Moderator
(5), Super Mod (6), Administrator (7). Matches the convention used
by the other staff-only acc_modtool_* keys.
Two changes:
- Default Database/FullDatabase.sql: fix the seed for fresh
installs.
- Database Updates/004_fix_acc_supporttool_rank.sql: idempotent
UPDATE to realign existing deployments.
Found by user report: a rank-2 (VIP) account on the live retro had
the ModTools button visible in the toolbar after login.
32 lines
1.3 KiB
SQL
32 lines
1.3 KiB
SQL
-- ============================================================
|
|
-- Fix: acc_supporttool wrongly granted to VIP / wrongly denied to Super Mod
|
|
-- ============================================================
|
|
-- The default permission_definitions seed shipped acc_supporttool
|
|
-- with rank pattern (0, 1, 1, 1, 1, 0, 1) — i.e. rank_2 (VIP) and
|
|
-- rank_3 (X, junior helper) had ALLOWED, while rank_6 (Super Mod)
|
|
-- did NOT. That's two bugs:
|
|
--
|
|
-- * VIP users see the ModTools button on the toolbar and can
|
|
-- open Room/User info windows. The actual sanction endpoints
|
|
-- still gate on ACC_SUPPORTTOOL server-side so they can't
|
|
-- actually moderate, but the UI exposure is wrong and lets a
|
|
-- VIP request user info / room info / chatlogs they have no
|
|
-- business reading.
|
|
-- * Super Mod is denied the tool entirely, which is obviously
|
|
-- unintended given the rank name.
|
|
--
|
|
-- Intended pattern: only Support (4) and up — (0, 0, 0, 1, 1, 1, 1).
|
|
--
|
|
-- Run on existing deployments to align with the corrected default
|
|
-- seed in `Default Database/FullDatabase.sql`. Idempotent.
|
|
|
|
UPDATE `permission_definitions`
|
|
SET `rank_1` = 0,
|
|
`rank_2` = 0,
|
|
`rank_3` = 0,
|
|
`rank_4` = 1,
|
|
`rank_5` = 1,
|
|
`rank_6` = 1,
|
|
`rank_7` = 1
|
|
WHERE `permission_key` = 'acc_supporttool';
|