Support

Akeeba Backup for Joomla!

#14757 User with just Backup Permissions can't access Backup

Posted in ‘Akeeba Backup for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Akeeba Backup version
n/a

Latest post by nicholas on Thursday, 24 January 2013 15:14 CST

careytech

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? 
Have I searched the tickets before posting? YES
Have I read the documentation before posting (which pages?)? YES
Joomla! version: (2.5.8)
PHP version: (unknown)
MySQL version: (unknown)
Host: (Siteground)
Akeeba Backup version: (3.6.12 PRO)

EXTREMELY IMPORTANT: Please attach a ZIP file containing your Akeeba Backup log file in order for us to help you with any backup or restoration issue. If the file is over 2Mb, please upload it on your server and post a link to it.

Description of my issue:

I created a new user group (backup manager) and gave that group permission to login to backend as well as "Allow" every permission for Akeeba Backup.  I assigned a user (who is not an admin) to this new group.  I logged in as that user.  While the user can see the Akeeba control panel, the user sees no input area after clicking on "Backup" (i.e., it is as if the view does not display).  I checked with ACL Manager, and it shows that this user should have full access to the component.

However, if I give the user global rights to edit, then that user can see the Backup screen.  Of course, the expectations are that access to a component should require only permissions set on the component and not the need to Allow global permissions.

 

nicholas
Akeeba Staff
Manager

I cannot reproduce this. Here is my testing protocol:

  • Fresh Joomla! 2.5.8 site with sample content and default Akeeba Backup Professional 3.6.12 installation
  • Created a new user group named "Backup Operators", inheriting from public
  • In Akeeba Backup, Options, Permissions I gave that group the Access Administrator Interface and Backup privileges.
  • Created a new user "operator" belonging to the Manager, Registered and Backup Operators user groups
  • I logged in as the "operator" user
  • I could see Akeeba Backup under the Extensions menu and click on it
  • I could not access any area except Backup Now
  • I was able to take a backup but not manage the backups or view the log, as intended

In a moment of inspiration I also tried the same thing on a site in which I deliberately screwed up the assets table, creating orphan assets and orphan categories that even ACL Manager wasn't able to fix. In this case I was able to see the Akeeba Backup component but I wasn't able to run a backup. Once I removed the problematic asset records (the ones that ACL Manager didn't detect and couldn't fix) I was able to log out, log back in and run the backup. For what is worth, when the site had broken assets records I would see lots of SQL errors displayed in red at the top of every page when I logged in as "operator".

If you have followed a different approach to creating a backup operator please tell me so that I can try using your method.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

careytech

Nicholas,

The one thing different you did was to assign the user also to Manager (which provides permission for logging in to the admin) whereas I have my new group includes that permission (admin login).  Actually, I create a group called "backend access" that does nothing by grant the right to login to the backend, and then my role-based groups each inherit from this group, picking up the permission for admin login.

So in your approach, the manager group adds the global permission to edit, whereas in mine (trying to follow least permissions), the only permissions granted are those provided by the component plus admin login.

I know I'm not alone in this approach or one similar.  Sander recommends removing almost all of the groups (but retaining Super and Registered) and add in groups as needed - meaning Manager and Administrator are no longer available - and that means global permissions are selectively granted and only if needed.

So I think the cause of my blank view is that I'm taking an approach that does not grant Edit globally, and somewhere the code that displays the view for the backup screen is checking that global permission.

 

[Additional info: this was from an established 2.5.x site with standard Akeeba backup.  The site is now at 2.5.8 and I had just upgraded Akeeba Backup to Pro.] 

 

nicholas
Akeeba Staff
Manager

I did try doing that too. In a third site I created the Backup Operators group and gave it only access to Akeeba Backup's access administrator interface and backup privileges and the global Admin Login privilege. However I ended up logging in to an empty page. I suppose that happened because the menu module's viewing access level didn't include my new group. I will try doing one more test later today, but I think I already know why the global core.edit privilege is required.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

careytech

I also thought it might be viewing access (access level).  I added the new group to Special, but that did not help.

And I thought perhaps the backup process did require some global permissions - somewhere within all the "magic" it does.  Thanks for looking into it.  It sure would be nice to be able to give a user just the permission to run a backup.

 

nicholas
Akeeba Staff
Manager

Excellent! Now I was able to have a test case which let me reproduce the issue and fix it. I am uploading a new dev release (svn1811) which solves this issue. Can you please install it and give it a try?

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

careytech

Nicholas,

I installed this new version on top of the old.  While it installed successfully, it reported a sizable list of your fof library files that it could not delete.

But that install now allows my test user to get access to the backup screen.  So this seems to have fixed what I was looking for.  Many thanks.

When do you expect to have this into a Stable release?  I'm asking just asking in case my client wants to know when I can get her access to the backup feature.

 

nicholas
Akeeba Staff
Manager

I will be improving the installer. What you saw was the result of an update of FOF from 1.x to 2.0. Something's amiss in my update code, I'm still working on it.

There is no ETA for a new stable release. Right now there are no show-stopper open issues and there are no major features planned for Akeeba Backup for the next 2 months (we're working full time on Subscriptions and then it's time to start working on Ticket System and get it released). That said, the dev release you used is very stable (except for the installer). You can certainly use it for your daily backups. That's what I do ;)

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

careytech

OK.  If you feel the dev version is essentially stable, that's good enough for me.  Again, thanks for the fix.

nicholas
Akeeba Staff
Manager

You're welcome! Thank you for the bug report and the feedback on the fix!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!