Non-admins can access the admin panel

[ocularvr]

When we setup a server we have two kinds of accounts for users, Admin and Non-Admin. So logic implies that a Non-Admin user should not have access to /admin
They do, but then there are permission issues with the contents of /admin - This is a bad idea because we should not fiddle around with page permissions, rather make the whole directory invisible to non admins. There is one exception, even with the wacky permissions, non admins can still play around with "Import content". The ideal scenario would be to make /admin only visible to Admins. The hard thing about Hubs is that its almost like a black box where its hard to debug and solve unless you have an aircraft carrier parked in your back yard (deploy a new client),
Thanks

[robinkwilson]

Good question. The way it works right now, non admins do not have access to the data so even if they try to import content, it shouldn't go anywhere. They can see the admin panel, but no data populates. Your instance is safe from any bad actors :)

Making a "You do not have access page" or a redirect for non admins was in an unspoken todo, your question inspired a trackable official issue! Thank you again for posting a question!!

#2999

[ocularvr]

Thank you for the quick feedback, much appreciated. We have a demo scheduled for tomorrow in Zurich so we just want to plan ahead and as you can imagine, security is a huge issue in Switzerland.

[robinkwilson]

Oh definitely! Glad I can help. Keep the questions coming :)

[robinkwilson]

PR opened for this: #3027