# Roles and Security flaw **URL:** \ **Category:** V5 Question\ **Created:** [August 8, 2022, 1:21pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051 "2022-08-08T13:21:40Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![digeratimvp](https://forum.sambapos.com/user_avatar/forum.sambapos.com/digeratimvp/32/51966_2.png) [@digeratimvp](https://forum.sambapos.com/u/digeratimvp)\ **Post date:** [August 8, 2022, 1:21pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/1 "2022-08-08T13:21:40Z")
Roles So we have roles. Roles are for permission restrictions. We have a Admin role. We have a Server role. We have a Bartender role. We have a Manager role. Everything is fine, UNLESS you have the need to grant any role access to the Manage interface. Why would anyone need access to this? Managers (or whichever role you want) often need access to the Menu items to change prices. Anyone you grant access to the Manage screen, has access to become an Admin or change roles and perms to whatever. Seems like such a security oversight. Any suggestions or are there any updates coming to address this? ---
**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\ **Post date:** [August 8, 2022, 1:22pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/2 "2022-08-08T13:22:27Z")
You can Restrict manage sections in the roles with Management Permissions section. Even if they are admin if you restrict the screen they won’t have access. ---
**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\ **Post date:** [August 8, 2022, 1:24pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/3 "2022-08-08T13:24:45Z")
> [@Security levels inside Managament](https://forum.sambapos.com/t/security-levels-inside-managament/7044/25): > > Added for 5.1.61 update. Setup permitted management sections for a user role. Management screen for this user role appears like that. ---
**Author:** ![digeratimvp](https://forum.sambapos.com/user_avatar/forum.sambapos.com/digeratimvp/32/51966_2.png) [@digeratimvp](https://forum.sambapos.com/u/digeratimvp)\ **Post date:** [August 8, 2022, 1:25pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/4 "2022-08-08T13:25:22Z")
Do you mean here? ![Screen Shot 2022-08-08 at 8.23.16 AM](https://forum.sambapos.com/uploads/default/original/3X/d/1/d1ac5b11dae18e943dda682c511852b4d4e2b1ea.png) If you uncheck OPEN MANAGEMENT, then you can not edit any menu items. If you DO allow, then they can edit the menu as we want, and they can still make themselves an admin. BAD. ---
**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\ **Post date:** [August 8, 2022, 1:25pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/5 "2022-08-08T13:25:36Z")
No I don’t please see above. It seems you have not found the manage permissions ---
**Author:** ![digeratimvp](https://forum.sambapos.com/user_avatar/forum.sambapos.com/digeratimvp/32/51966_2.png) [@digeratimvp](https://forum.sambapos.com/u/digeratimvp)\ **Post date:** [August 8, 2022, 1:26pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/6 "2022-08-08T13:26:24Z")
Ok I will look into that, Thanks ---
**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\ **Post date:** [August 8, 2022, 1:26pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/7 "2022-08-08T13:26:56Z")
We added this in 2016 due to the demand for restricting this screen by role. ---
**Author:** ![digeratimvp](https://forum.sambapos.com/user_avatar/forum.sambapos.com/digeratimvp/32/51966_2.png) [@digeratimvp](https://forum.sambapos.com/u/digeratimvp)\ **Post date:** [August 10, 2022, 3:16pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/8 "2022-08-10T15:16:33Z")
The security levels edits that you provided works well to limit roles even further, I do like that. However see if you can help with this. Let’s say in a restaurant will lots of staff, you have a hostess, and this hostess is not in the computer as a user yet,there is no need. Then it’s a busy night, and several have called in sick and now we need this hostess to be in the system and working as a server. The manager on duty, as you can see above now has limits like we want, but we need the manager to be able to add users. Might not seem like a problem, you could simply add permissions to access the user portion. HOWEVER then they would be able to add a user, and make that user an admin role. Seems like an oversight. Is there a way to limit that, or can we somehow set the system to have a button or something to add a default user that you already have setup with a role? ---
**Author:** ![Posflow](https://forum.sambapos.com/user_avatar/forum.sambapos.com/posflow/32/63001_2.png) [@Posflow](https://forum.sambapos.com/u/Posflow)\ **Post date:** [August 10, 2022, 3:51pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/9 "2022-08-10T15:51:05Z")
You can create custom automation for that, which will insert new user into database and all you need to do is define the PIN number. ---
**Author:** ![digeratimvp](https://forum.sambapos.com/user_avatar/forum.sambapos.com/digeratimvp/32/51966_2.png) [@digeratimvp](https://forum.sambapos.com/u/digeratimvp)\ **Post date:** [August 10, 2022, 5:50pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/10 "2022-08-10T17:50:04Z")
Any info on where this is? Is there a tutorial? ---
**Author:** ![Posflow](https://forum.sambapos.com/user_avatar/forum.sambapos.com/posflow/32/63001_2.png) [@Posflow](https://forum.sambapos.com/u/Posflow)\ **Post date:** [August 10, 2022, 6:02pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/11 "2022-08-10T18:02:11Z")
No there will not be a tutorial for this. You will need to use built in JScript engine and SQL > [@JScript Helpers and Functions](https://forum.sambapos.com/t/jscript-helpers-and-functions/11966): > > Compilation of the helpers that are available in JScript and [=expressions]. Background The script engine currently implemented in SambaPOS 5 is actually Microsoft JScript (similar to JavaScript) which is ECMAScript 3 (ES3 (Dec 1999)) compatible. As such, some functionality that you might find on the internet does not apply, such as new functionality added in ES5 (Dec 2009), ES6 (2015), or ES7 (2016). More information: [https://blogs.msdn.microsoft.com/jscript/2007/10/29/ecmascript-3-and-…](https://blogs.msdn.microsoft.com/jscript/2007/10/29/ecmascript-3-and-beyond/) > **[SQL Tutorial](https://www.w3schools.com/sql/)** > > W3Schools offers free online tutorials, references and exercises in all the major languages of the web. Covering popular subjects like HTML, CSS, JavaScript, Python, SQL, Java, and many, many more. ---
**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\ **Post date:** [August 10, 2022, 6:31pm UTC](https://forum.sambapos.com/t/roles-and-security-flaw/26051/12 "2022-08-10T18:31:15Z")
It is an internal api call to create users. This can be automated and I have seen some resellers build it into a management entity screen.