Staff can edit other staff using the user buckets bypassing permission checks

[Steve Callender]

Tested in EG 3.9.2

Staff members that do not have permission to edit users in certain permission groups can bypass the permission blocks by adding a staff member to a bucket and doing a batch edit.

I tested with a staff account editing another account they do not have permission to edit. In the patron editor it's blocked with the message "Editing users in this group is disallowed". However, putting that user in a bucket allows me to change the individual account settings that are part of the batch edit process, such as home library, or profile that would allow me to move that user into a permission group that I CAN fully edit.

[Steve Callender (stevecallender)]

Update, I cannot edit the permission group this way, but I can edit the home library and everything else, but the permission group/profile still successfully blocks and requires an override.

[Galen Charlton (gmc)]

Confirmed. Somebody with UPDATE_USER normally cannot edit a user record at all unless they have the relevant application_perm corresponding to the record's profile, but via batch patron update (assuming they have the CONTAINER_BATCH_UPDATE permission) they can get past this restriction in certain contexts:

- barred: if they have BAR_PATRON/UNBAR_PATRON
- active, juvenile, expire_date, net_access_level: all they need is UPDATE_USER
- home_ou: they need UPDATE_USER at both the old and new orgs

However, they _cannot_ change the profile unless they have the corresponding application_perm.

This doesn't appear to support a privilege escalation attack, but could support a denial of service attack against other staff users.

[Mark Massey (mtm-ccld)]

I was able to remove "staff" from this list and add "staff member" from the page below page.
change *YOUR_LIBRARY* to the correct address

https://*YOUR_LIBRARY*.missourievergreen.org/eg/staff/admin/local/permission/grp_tree_display_entry

I was then able to change the main (profile) permission group from patron to staff member while editing an account