Body: <p>We bought the Charge Plugin and got it up and running for a subscription service and the website has just gone live.  We just realised any new user (subscriber) has access to all other users details if they know the control panel URL!!</p>
  
  <p>Charge is the only plugin ignoring user permissions in the CP.  With all permissions turned off, Charge is still available in the left hand panel.</p>
  
  <p>Please advise A.S.A.P.</p>
  
  <p>Thanks</p>
  
  <p>Martin</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T16:23:32.877Z
Comments.Text: Did you gave your users access to the plugin itself in the first tab? Each plugin can define custom permissions, but craft can set a default "access" permission. If you turn it off it should disappear. Of course only if they are not admins. Check your usergroup configuration, it must be a error on your site
Comments.UserDisplayName: Robin Schambach
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T16:27:15.520Z
Comments.Text: Sorry Robin, I don't know what you mean?
Comments.UserDisplayName: Martin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T16:28:49.980Z
Comments.Text: please make a screenshot of your userpermissions from a user
Comments.UserDisplayName: Robin Schambach
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T16:36:33.303Z
Comments.Text: New user view http://prntscr.com/hni0nk
Comments.UserDisplayName: Martin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T16:37:53.623Z
Comments.Text: Admin permissions screen http://prntscr.com/hni1jx
Comments.UserDisplayName: Martin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T16:40:02.747Z
Comments.Text: Do your users have separate permissions? Because if not they should not even be able to see the cp. They must be in multiple user groups or they have separate permissions. You can go into your user section, click on one of them and see what each user can do
Comments.UserDisplayName: Robin Schambach
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T17:00:56.403Z
Comments.Text: Yes, each user has access to Charge but this seems to have been automatically added? http://prntscr.com/hnicwi
Comments.UserDisplayName: Martin
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T17:04:30.517Z
Comments.Text: Check your member group... I'm pretty sure it has those permissions maybe you or someone of your team included that my mistake. I can't imagine charge is giving those by default since it's a mayor security issue
Comments.UserDisplayName: Robin Schambach
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-14T18:17:32.177Z
Comments.Text: Were you able to correct it? If not maybe there is a hook/event that grants those permissions. You could try to disable other plugins (in your developing environment) and check if the issue still occurs
Comments.UserDisplayName: Robin Schambach
Tags: <control-panel><permissions>
Title: Charge Plugin - Subscribers have access to the Control Panel and any other subscribers personal information
ThreadText: # Charge Plugin - Subscribers have access to the Control Panel and any other subscribers personal information
  
  (Asked by: username_0 on 2017-12-14)
  
  We bought the Charge Plugin and got it up and running for a subscription service and the website has just gone live. We just realised any new user (subscriber) has access to all other users details if they know the control panel URL!!
  
  Charge is the only plugin ignoring user permissions in the CP. With all permissions turned off, Charge is still available in the left hand panel.
  
  Please advise A.S.A.P.
  
  Thanks
  
  username_0
  
  **Tags:** control-panel, permissions
  
  > **Comments:**
  > **username_1**: Did you gave your users access to the plugin itself in the first tab? Each plugin can define custom permissions, but craft can set a default "access" permission. If you turn it off it should disappear. Of course only if they are not admins. Check your usergroup configuration, it must be a error on your site  
  > **username_0**: Sorry username_1, I don't know what you mean?  
  > **username_1**: please make a screenshot of your userpermissions from a user  
  > **username_0**: New user view http://prntscr.com/hni0nk  
  > **username_0**: Admin permissions screen http://prntscr.com/hni1jx  
  > **username_1**: Do your users have separate permissions? Because if not they should not even be able to see the cp. They must be in multiple user groups or they have separate permissions. You can go into your user section, click on one of them and see what each user can do  
  > **username_0**: Yes, each user has access to Charge but this seems to have been automatically added? http://prntscr.com/hnicwi  
  > **username_1**: Check your member group... I'm pretty sure it has those permissions maybe you or someone of your team included that my mistake. I can't imagine charge is giving those by default since it's a mayor security issue  
  > **username_1**: Were you able to correct it? If not maybe there is a hook/event that grants those permissions. You could try to disable other plugins (in your developing environment) and check if the issue still occurs  
  
  ---
  
  ## 0 answers
  
  