# Non-leader permissions wiped out **URL:** \ **Category:** Scoutbook & Scoutbook Plus Bugs\ **Created:** [April 17, 2021, 4:32pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604 "2021-04-17T16:32:03Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![JoeMcKinley](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@JoeMcKinley](https://discussions.scouting.org/u/JoeMcKinley)\ **Post date:** [April 17, 2021, 4:32pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/1 "2021-04-17T16:32:03Z")
I got a complaint from a parent today that they could no longer send messages to the unit, so I looked at the underlying permissions. It looks like for any adult who is not a leader or a former leader of any unit, i.e., they have never had anything but a parent connection, all of their connections with all scouts except their own children were severed, even the ‘View Profile’ permission. So I now have over 7500 ‘View Profile’ permissions to restore… ---
**Author:** ![JoeMcKinley](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@JoeMcKinley](https://discussions.scouting.org/u/JoeMcKinley)\ **Post date:** [April 17, 2021, 5:19pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/2 "2021-04-17T17:19:13Z")
Even worse, attempting to restore ‘View Profile’ is giving them ‘View Advancement’ instead. ---
**Author:** ![edavignon](https://sea2.discourse-cdn.com/scouting/user_avatar/discussions.scouting.org/edavignon/32/16_2.png) [@edavignon](https://discussions.scouting.org/u/edavignon)\ **Post date:** [April 17, 2021, 5:19pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/3 "2021-04-17T17:19:41Z")
Joe, These connections should only have been changed to View Profile or View Advancement. The easiest way you can restore this is with the Permissions By Position function of the the volunteer written and supported Feature Assistant Extension for Scoutbook for Chrome and Firefox. See [Feature Assistant - What is it?](https://discussions.scouting.org/t/feature-assistant-what-is-it/98647) for details on the extension. Another way to restore them quickly is to use Connection Manager then click on the parent name. Due to a bug, parents will be given View Advancement to all Scouts even if you only select View Profile. ---
**Author:** ![JoeMcKinley](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@JoeMcKinley](https://discussions.scouting.org/u/JoeMcKinley)\ **Post date:** [April 17, 2021, 5:22pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/4 "2021-04-17T17:22:29Z")
I cannot restore to View Profile. Now permissions are stuck on View Advancement. This would seem to me to be a priority 1 security bug that should be addressed ASAP. ---
**Author:** ![edavignon](https://sea2.discourse-cdn.com/scouting/user_avatar/discussions.scouting.org/edavignon/32/16_2.png) [@edavignon](https://discussions.scouting.org/u/edavignon)\ **Post date:** [April 17, 2021, 5:23pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/5 "2021-04-17T17:23:37Z")
Allowing parents to see other youth advancement is not considered a security issue. Anyone can typically look at a Scout’s uniform and see what advancement has been earned. ---
**Author:** ![JoeMcKinley](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@JoeMcKinley](https://discussions.scouting.org/u/JoeMcKinley)\ **Post date:** [April 17, 2021, 5:25pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/6 "2021-04-17T17:25:10Z")
I beg to differ. You can see a lot more than the array of badges earned. You can access advancement in progress, notes, etc. ---
**Author:** ![Matt.Johnson](https://sea2.discourse-cdn.com/scouting/user_avatar/discussions.scouting.org/matt.johnson/32/23672_2.png) [@Matt.Johnson](https://discussions.scouting.org/u/Matt.Johnson)\ **Post date:** [April 17, 2021, 6:37pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/7 "2021-04-17T18:37:40Z")
> [@JoeMcKinley](#): > > You can access advancement in progress, notes, etc. The person already has access to first name last initial. Advancement is not PII or private. As it was said, you can look at their uniform or hear progress at a Court of Honor. ---
**Author:** ![JoeMcKinley](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@JoeMcKinley](https://discussions.scouting.org/u/JoeMcKinley)\ **Post date:** [April 19, 2021, 6:33pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/8 "2021-04-19T18:33:40Z")
So in your opinion, it would not be a problem for someone to pickup a Scout’s physical handbook (not their own child) and start looking through their advancement signoffs without their permission? On top of that, they can look through the personal notes between the scout and MB counselors and other leaders? And look at photos, and documents the scout has uploaded attached to their advancement activity? It would be fine if the permission was limited to showing the display of ranks and awards earned, but it goes well beyond that. ---
**Author:** ![Matt.Johnson](https://sea2.discourse-cdn.com/scouting/user_avatar/discussions.scouting.org/matt.johnson/32/23672_2.png) [@Matt.Johnson](https://discussions.scouting.org/u/Matt.Johnson)\ **Post date:** [April 19, 2021, 6:51pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/9 "2021-04-19T18:51:37Z")
I do not think it is a “priority 1 bug”. It is not PII. It is also not world readable, only to parents in the unit, no? ---
**Author:** ![system](https://global.discourse-cdn.com/scouting/original/1X/66e9612584db5dbf76de17f00ad877998c0ba3d6.png) [@system](https://discussions.scouting.org/u/system)\ **Post date:** [April 26, 2021, 6:52pm UTC](https://discussions.scouting.org/t/non-leader-permissions-wiped-out/234604/10 "2021-04-26T18:52:19Z")
Closed on April 26, 2021, 6:52pm UTC This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.