Have (Project)Manager level between Write and Admin - admin gives access to all projects

Mal_Duffin · February 13, 2018, 2:12pm

Sometimes it’s useful to have someone added as admin to a project ( to add / remove users, carry out other high-level admin features to that project ).

When you add someone on a project and change their access level to Admin, they get access to all of your projects.

When I did this, as it was on a project basis, I assumed that they would only have access to that project - I was quite surprised when they had access to all of my projects.

mikefinch · February 13, 2018, 2:15pm

Wow, sounds like a security vulnerability. Are you sure about that?

Mal_Duffin · February 13, 2018, 2:23pm

Hi Mike,

It was reported by one of the students who I had set to admin.

I’ve just added you as admin to one project ( Wheelworks VR - Glengormley ), see if you can see a few more ( eg Wheelworks VR - Rathcoole )

mikefinch · February 13, 2018, 2:26pm

Nope, I see only this one for now

yaustar · February 13, 2018, 2:29pm

Is this an Org account? If so, all members of the Org should be able to see all the projects that belong to the Org.

Mal_Duffin · February 13, 2018, 2:33pm

It’s a Personal account, not an Org account, and the students were all signed up with a free account.

I’ll be back in 2 weeks with the group ( it’s a 6 week x 2 hour sessions per week, with sessions every week or two ), and will check again with the student who was able to access the projects to see exactly what he saw / get screenshots etc.

mikefinch · February 13, 2018, 2:39pm

I’m sorry for offtop, but… Do you teach students with PlayCanvas? Is it university program or just special course?

Mal_Duffin · February 13, 2018, 2:50pm

It’s just a one off course, with two sets of groups ( about 10 kids ) for 6 sessions each, getting them introduced to VR ( the collaborative element of PlayCanvas is great, but can also be a bit of a nightmare - I put in a feature request for locking object, eg the Root object - when a rowdy student gets hold of that and starts scaling and rotating it, it’s a nightmare lol )

Mal_Duffin · February 13, 2018, 2:54pm

After the sessions ( about 12 hours for each group, with half of that is actively using PlayCanvas, the other half is more general info on VR and also design ), the final result will be some content generated by the students.

Hopefully this initial trail will lead on to more projects, in which case something more substantial can be organised - this was very much a trial to see if it could work.