So I’m still having fun working through security and permissions on the 7.11.22 installation I inherited.
It’s been set up with permissions managed at the default screen level, with additional controls at the field level (using a plugin).
It seems to me, though, that the security model is topsy-turvy: if a user is not in any role groups, there seems to be access to the full system, both for the SuiteCRM-managed permission and the field-level ones managed by the plugin.
Is this the standard behaviour of SuiteCRM, or something in our configuration? I couldn’t find anything in the docs or anything obvious in the admin control panel.
This seems like a bit of a problem, as it’s all too easy to accidentally forget to assign a user a role when setting up a new user – surely the default should be no access without a role…?