I have "You do not have sufficient permissions to access this page." issue when trying to access Wordpress wp-admin login as an administrator. The login page appears, but when the user details are entered the "You do not have sufficient permissions to access this page." appears.
The strange part is that I have another administrator account that accesses with no error.
I tried to create a new administrator account, but that also cannot access giving the above error message.
I have looked into the database and the users that don't work have wp_capabilities of a:1:{s:13:"administrator";b:1;}
The user that does work has: a:2:{s:13:"administrator";b:1;s:13:"bbp_keymaster";b:1;}
I am also running S2 Member plugin.
The only difference I can see between the account is this beginning section of a:1 and a:2. All of the sites I see say the account should be a:1
I don't think it is a plugin issue, as I assume then I would not be able to access either. I think perhaps something to do with s" Member plugin, but I'm now at a bi of a loss.
All plugins are updated and running Wordpress 4.0 (however this was an issue even before upgrade to 4.0)
All help gratefully received!
The only difference I can see between the account is this beginning section of a:1 and a:2.
Look more carefully. The working example has a whole extra section: s:13:"bbp_keymaster";b:1;
To understand why that matters, it helps to know that that is the format produced by by PHP's serialize() function.
If you unserialize each of those strings, you will find that the first is an array with 1 entry (hence a:1), with the key 'administrator' and a value of true. The longer string is an array with that entry plus another one, with the key 'bbp_keymaster', also set to true.
From this, it's easy to surmise that 'administrator' and 'bbp_keymaster' are the internal names for permissions which can be granted to a user, and the page in question is only available to users with the 'bbp_keymaster' permission.
Related
First, thanks Hasura for incredible good product! I love it.
I have issue with derive action with Hasura Console. My use case:
I enable anonymous role for subscribe function (everybody can send email to subscribe)
I have configured permission on my subscribe table, everything is fine.
I want to validate the user input on server side, for example, validate email format. I have followed by this guide about derive action. I found no mistake here.
But I got the error "Type query_root must define one or more fields." when I hit "Derive action" at the first time.
According to this question, as I understand, I need to have object type for root query.
Of course, I will have object type for root query eventually. I can work around by giving some dummy queries for anonymous role. But I do not like that cheat anyway.
Any idea on that? Any help will be highly appreciated.
Edited:
My related current version:
Hasura 1.3.2
One click deployment using Docker on Digital Ocean.
Hello to forum from a part time occasional user of MS Access 2010:
Trying to get permission to allow a third party application read MsysObjects which in turn will allow it to save a copy of the table relationship window in a form that will allow the layout to be recovered when it crashes (frequently - and is a known irritation/bug).
Have tried the method suggested in quote from this forum [HansUp] without success - including substiting this DAO line for the last ADO line following advice on a different forum:
dbEngine(0)(0).Execute strDdl, dbFailOnError
Since your db is ACCDB format, you will be working as user Admin. You can confirm that point in the Immediate window. (Go there with Ctrl+g)
? CurrentUser()
Admin
Since Admin doesn't have read (SELECT) permission on MSysObjects, execute a DDL statement to give Admin that permission.
strDdl = "GRANT SELECT ON MSysObjects TO Admin;"
CurrentProject.Connection.Execute strDdl
Advice from yet another forum to import or export to fresh blank accdb gives no result as permissions are still not available.
All this is beyond my pay grade so any advice welcome.
I have created my first Facebook app in R. Its purpose is solely to retrieve marketing data from my Facebook pages. So far I have created this (no authentication problems):
require("Rfacebook")
load("fb_oauth")
## Start retrieving insight from VivaraDE
rawinsightsDE<-getInsights(object_id= "my_id", token = fb_oauth,
metric="page_impressions", period = "days_28", version="2.6")
When running this, R does return:
Error in FUN(X[[1L]], ...) :
No data available. Are you the owner of this page? See ?getInsights.
I have an administrator role in my app (obviously) and an admin role on the page desginated by my_id.
I suspect I will have to alter some config somewhere. What am I missing?
You need read_insights permission from the page admin (you in this case), before you can access these metrics.
Any more common permissions I need to include, so I won't stumble upon some more rejections?
Nah, don’t ask for permissions “just to be on the safe side” – that will only give problems in review (if the app is supposed to be used by the general public at one point?), if they see you asking for permissions without actually using them.
I’d rather suggest you use Graph API Explorer first to test out the request you want to make; its debug feature usually displays a message in such cases as to what permission is missing to get the requested data.
I am trying to do some development to the LogisticsPostalAddress form that is used on forms where an address is modified/added. When trying to add an address (e.g. to an existing Customer) I get the error.
You are not authorized to access table ‘Shipping carrier’ (ShipCarrierAddress). Contact your system administrator.
I have scoured the user permissions and cannot find a way to give permission to this table. I would think that adding an address is a basic function, so can not figure out why I can't.
Thanks,
Kevin
What role is your user assign to? Are you sure users in that role should be able to add addresses to the customer? If yes, here is how you can add permissions to the ShipCarrierAddress table:
With admin user, open development envionrment (Ctrl + Shift + W from
running Ax, or run "ax32.exe -development" from command prompt)
In the AOT, go to Security > Roles. Find the role your user is assigned to.
Exapand the Role > Permissions > Table, add new table and set table name to ShipCarrierAddress and EffectiveAccess (in your case
you want to insert, thus set to Create)
Save the role, and compile the role (not sure if compile is mandatory)
Start a new Ax instance with the user with limited permissions and verify you have access.
I turned out it was an issue with the installation of the lab.
This probably isnt an issue with SiteCore per se but I've included it for completeness. I have sitecore 6.3 running under IIS7 using a custom identity for the app pool. I cant get Sitecore to write its logging information (using the default log4net settings) to the eventlog. I've followed the advice here: http://logging.apache.org/log4net/release/faq.html#Why%20doesn%27t%20the%20EventLogAppender%20work? and although it works fine when I make the custom identity a member of the administrator's group I need to find a way to get it working in production without such a security hack.
The weird thing is that I have a MSI that installs it (running under an account which IS a member of the administrator's group) and creates the correct registry keys in the eventlog for me and yet despite that, I am still getting the following error when I run the application using the custom identity (without it being a member of administrators).
log4net:ERROR DOMConfigurator: Could not create Appender [EventLogAppender] of type [log4net.Appender.EventLogAppender]. Reported error follows.
System.Security.SecurityException: Requested registry access is not allowed.
at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)
at System.Diagnostics.EventLog.GetEventLogRegKey(String machine, Boolean writable)
at System.Diagnostics.EventLog.FindSourceRegistration(String source, String machineName, Boolean readOnly)
at System.Diagnostics.EventLog.DeleteEventSource(String source, String machineName)
at log4net.Appender.EventLogAppender.ActivateOptions()
at log4net.Repository.Hierarchy.DOMHierarchyConfigurator.ParseAppender(XmlElement appenderElement)
The Zone of the assembly that failed was:
MyComputer
log4net:ERROR DOMConfigurator: Appender named [EventLogAppender] not found.
Thinking I could narrow it down to a registry permission issue I granted Everyone full permissions to the following registry key and subkeys but it didnt work either: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog
The custom identity is a member of the following groups:
Event Log Readers
IIS_USERS
Performance Monitor Users
I've also seen the following question which seems to ask the same thing. The Microsoft article seems to suggest it might be a problem with ACLs on an event log and gives examples on how you can change SSDLs but I'd rather avoid that if at all possible.
EDIT:
I have another server running where the log is being populated fine. The custom identity was a member of administrators so I revoked that and rebooted, trying to purposely break it but I cant. Config is identical on both boxes and same identity used to run the MSI which creates the registry keys. Have run procmon on both (after doing a IISReset and spinning up the app pool again) to examine registry activity. Strange thing is - on the box that works you get 477 name not found records for my event source in the wrong places (Application, and a different Custom EventLog "MyCompany"). No hits for the place where it is logging which is "MyCompany\MyCompany.SiteCore". Whilst on the box which is broken, it does appear to be requesting to read the right key (albeit only 6 times) but you then get the Log4Net registry access error.
As I understand it EventStores are stored in the registry, so you only need write permission to registry to create or delete an EventStore. This is usually only needed once and most applications create this as part of the install procedure so that the application does not need to be run as Administrator during normal execution.
However your error message (in the question) includes the method DeleteEventSource from which I would deduce/guess that the EventSource does exist but is wrong in some way. So perhaps this is currently registered as writing to the event log named MyCompany and you are now trying to change it to "MyCompany\MyCompany.SiteCore" which requires you to delete the old eventsource and create a new one.
So it sounds like your installation routine is creating a different EventSource from the one that your application is actually using.
If that doesn't help, then I would suggest enabling internal logging for Log4net (but obviously not to the eventlog) which will probably give you more information.
Giving full permission to the registry key is not enough.
According to Microsoft
To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.
The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a SecurityException is thrown.
Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.
I think, contrary to the Apache documentation, log4net DOES need write access to the registry – or at least it does in my case. To prove this, I backed up the registry on the server where it wasnt working and granted IIS administrator privileges before spinning up sitecore. Sure enough it started logging away to the eventlog nicely and then when I exported the registry again to run a diff, there WAS a difference.
The value for the eventlogmessage file on my event source had been updated from:
C:\Windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
To
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\EventLogMessages.dll
So I assumed that merely changing this value in the registry by hand would work.
But it didn’t.
So I ran procmon on the two servers I have: A=the working one, B=the failing one. Sure enough, on server B I have a line which says:
Operation: RegOpenKey, Path: HKLM\System\CurrentControlSet\Services\EventLog, Desired Access:Read/Write, Result: ACCESS DENIED.
I’ve traced through with Server A and in exactly the same place, the key is requested with Desired Access:Read.
Conclusion:
It seems unavoidable that I will need to grant my app pool identity administrator privileges in production for at least enough time to programatically do the necessary registry writes the first time from within log4net. I dont know why administrator; I have tried granting Full permissions to the entire eventlog node in the registry for my custom app to no avail. It seems to do something which I cannot identify or pin down. I will then revoke this privilege immediately after it starts to log and monitor whether subsequent installs knock out the functionality afterwards. (Hopefully not).
If anyone has any insight into this behaviour it would be greatly appreciated.