[#3201] Not Authorized when editing in backend

That's not necessarily a bug. It results in GID being missing so it's always going to cause authorization checks to fail. The params field always needs to be available, but it doesn't have to be visible (see CB > Configuration > User Profile).

What do you mean by GID? As mentioned in the bug report, if params field is missing then there are no "approved" and "confirmed" vars submitted with the form and the security check on line 117 of administrator/components/com_comprofiler/controller/controller.user.php fails.

For me, if I can "configure" a software to break somehow it is a bug and this is the case. If the params field is moved to a tab wich is not published CB does not work anymore in backend. Your opinion may differ.

ndee wrote: What do you mean by GID? As mentioned in the bug report, if params field is missing then there are no "approved" and "confirmed" vars submitted with the form and the security check on line 117 of administrator/components/com_comprofiler/controller/controller.user.php fails.

For me, if I can "configure" a software to break somehow it is a bug and this is the case. If the params field is moved to a tab wich is not published CB does not work anymore in backend. Your opinion may differ.

I agree that there is way too much flexibility and users can mess things up by not doing things properly.

As Kyle said:

The params field always needs to be available, but it doesn't have to be visible (see CB > Configuration > User Profile).

nant wrote: As Kyle said:

The params field always needs to be available, but it doesn't have to be visible (see CB > Configuration > User Profile).

Ok, which option? "Fields Validation"? If set to no, it does not solve the problem. The other options do not seem related? Please be clear which option set to what.

I can just say it a third time. If the params field is on an unpublished tab the security check fails because the $_POST data vars "approved" and "confirmed" are missing.

Ok, which option? "Fields Validation"? If set to no, it does not solve the problem. The other options do not seem related? Please be clear which option set to what.

Set "Allow user to edit his CMS parameters in frontend" to "No" and it won't show those fields anymore on frontend.

I can just say it a third time. If the params field is on an unpublished tab the security check fails because the $_POST data vars "approved" and "confirmed" are missing.

It's not supposed to be on an unpublished tab. It must always be present. It contains hidden fields that are set by the Params field that are vital to a users storage such as approval, confirmation, and GID(s).

Ok, now I understand. We are talking about different things. I was talking about the BACKEND. Even Super Administrator can't edit/save users or even his own profile in backend if the params field is on unpublished.

It might help if you just take a look at the mentioned source code. Therefore I suggested that the approved and confirmed params get by default included into backend edit. But maybe there is a better solution.

But I take it as it is. I can't waste more time making my point if you are unwilling to see the problem or even try to reproduce my error. This bug already took too much time and frustration. Take it or leave it.