People with manage roles cannot give themselves a role with a permission they don't have

TollyThaWally
I think that if you have someone with manage roles, they can't give themselves a role that has permissions they do not, even if it is below their role. For example, if I have a moderator who does not have Administrator permissions, they should not be able to give themselves the bot role which has Admin but is below them
17

Comments

2 comments

Date Votes
  • Lear

    I disagree with this. The point of the positioning of the roles is to act like a hierarchy. Lower roles have lower permissions. Do not grant admin permissions to a low based role. Instead, you should have all the admin ranks up the top. 

    -1
  • Hexcede

    I disagree with Lear, and, I think this request is still completely relevant now despite its age. It's impossible to have roles that have the same level on the hierarchy. You can't have two roles that are in the same spot, thus, if you want to have two roles with similar or identical permissions, one role can always access the other. The workaround I use is to add the permissions to a placeholder role that goes above both, but, this is hacky and should be unneeded. Additionally, it severely limits the applications of roles. What applications do you have by allowing higher roles to just give themselves more permissions? There is no situation where this functionality is useful to a server owner.

    It's pointless to say "but that's not how you should do it" when the way that you "should" do it simply adds complexity to something that didn't need to be complex to begin with. Its finicky to properly set up permissions, especially because there is no way to easily see if you are violating the rule to begin with. I have seen servers destroyed because someone misclicked and dragged a role to low, potentially allowing a whole staff team access to the Administrator perm.

    And, this mostly isn't a worry of abuse of power, this is a worry of account breaches on top of potential abuse of power. They happen frequently, even with staff that have 2fa enabled, I have seen several servers completely destroyed because a staff member who wasn't being safe got token logged. And, exploits happen on Discord, as they do anywhere else. There have been multiple exploits prior that could have potentially been used to get login info or account tokens indirectly, e.g. through phishing.

    An example of how that could have recently occurred is when the link formatting bug was recently a thing, where a link could be completely disguised as another. The same exploit could have been used to link to a normally perfectly safe executable, but instead it could have been a token logger.

    It's not a good idea to have the mentality of "well, you're not doing it right" when the "right" way is more risky than the proposed way.

    Lastly, not all server owners handle their servers correctly. It's better to provide safer ways to begin with than to leave it completely up to the server owners to protect their servers properly. I have seen hundreds of servers that have their permissions set up improperly, and have seen countless examples of permission abuse, whether it just be from staff joking around, or minor things that were handled, they happen all the time, and, I think these sorts of things should be addressed.

    0

Please sign in to leave a comment.