3CX rights give unintended privileges

[bakhtiyar123]

Hello. I have 3CX server version 18.0 Update 8 (build 939). I used to give rights to user extensions to let them be able to do some tasks. It was fine in the past. But after some updates to 3CX server, I see some other rights have been added(Manager, User, Receptionist, Group administrator, Group owner, System administrator, System owner). I have the least privileged right which is "Manager" to be able to listen to the group recordings. But when Manager right is assigned to an extension, that user can see all the call logs in the 3cx system through "reports - > call log" in the Webclient and also can create user in its own group and delete any user in its own group. I need to give only the right to listen recordings of its group members. The Manager right assigned user extension should not gain any other right which was not intended.

 

[Alphabetic]

User, Manager and Receptionist have been around for a while.

https://www.3cx.com/docs/access-roles/

Check the link to see what roles have what rights.

if they want recordings only, then dont assign the role and just select from rights page.

 

[bakhtiyar123]

User, Manager and Receptionist have been around for a while.

https://www.3cx.com/docs/access-roles/

Check the link to see what roles have what rights.

if they want recordings only, then dont assign the role and just select from rights page.

I appreciate your help. But I have already tried it. It is impossible. When the role is set to "user" then recording right is unclickable. I dont know if it is a bug or not but I can not check the box. I also tried it with receptionist role with no success. I need to let the user to see only her own group recordings. If you want to let the user to see recordings then at least you should assign manager role. Then the user will have many unintended privileges.

 

[Alphabetic]

When youve changed it to user, turn on "allow access to management console" and select the monitor box.

 

[Yellow_Flash]

Give the extension, "user" rights instead of manager rights, and provide them with the "can see group recordings" access. This works only with the Professional or Enterprise Licenses.

 

[bakhtiyar123]

Give the extension, "user" rights instead of manager rights, and provide them with the "can see group recordings" access. This works only with the Professional or Enterprise Licenses.

I have tried it already. It is impossible. When you set the role as "user" then you can not click on the box "can see group recordings".

 

[bakhtiyar123]

When youve changed it to user, turn on "allow access to management console" and select the monitor box.

I have tried it. When I did that the user had privilege to delete recordings. it is unintended privilege. I need only to see the group recordings. that is it. nothing else.

 

[Yellow_Flash]

I believe you don't have the necessary privilege to do this.
If you are using a free version of 3CX, then you wont be able to do this.

 

[bakhtiyar123]

I believe you don't have the necessary privilege to do this.
If you are using a free version of 3CX, then you wont be able to do this.

I have liscenced enterprise 3CX server. I am intermediate certified and I have 3 years of experience in administration of 3CX. I need deeper solutions than this.

 

[Alphabetic]

Revoke access to the mgmt console, in the group set the ext to user and check "can see group recordings and reports".

then go to phone provisioning / 3CX App and check "show call recordings" at the bottom and remove "Allow deletion".

 

[bakhtiyar123]

Revoke access to the mgmt console, in the group set the ext to user and check "can see group recordings and reports".

then go to phone provisioning / 3CX App and check "show call recordings" at the bottom and remove "Allow deletion".

As I see I could not explain my point. I have already configured the user rights therefore the user can see the recordings of its own group. But it has unintended privileges that lets him to delete or create users in webclient UI. I am asking for help that how to let the user see recordings but at the same time not letting other unintended privileges to be given to the extension.
1. I have checked " show all recordings"
2. I have set manager role to the extension. Because without manager role you can not check the "Can see group recordings and reports" box, because it becomes unclickable. That is why Manager role is the least privileged role to be able to see the recordings.
On the other hand the Manager role assigned user can create, delete other extensions in its own group.
At least we should be able to restrict this privilege.

 

[Alphabetic]

Ok, I refer you back to the link I posted above that tells you what roles get what access. This has changed, so you need to adapt. Forget giving your user manager role. Give them user role with selective additions.

 

[Alejandro_3CX]

Hi @bakhtiyar123 you can assign the extension the Manager Role, then enable the PBX console restriction from the pbx security menu, add only the static public IP address used by the system owner or system admin.

In this way, if the user access the webclient from a different public IP, he will not have the admin access wheel, but he can access to the recordings since that feature is out of the admin menu.

Have a good one!