# Bug OP-18688 - Users with the "Manage Users" permission did not see links to Lock/Unlock users

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-18688

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 17.0.2 |
| Observed in versions | 17.0.0 |
| Sprint | 17.0.2 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 17.0.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Klaus Zanders |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### 

### Steps to reproduce

1.  Create a user that has the `Manage Users` permission through a global role

2.  Log in as that user

3.  Go to Administration -\> Users & Permissions -\> Users

### What is the buggy behavior?

  - In the last column there are no links to lock/unlock users

### What is the expected behavior?

1.  For every user (except oneself and full administrators) you are supposed to see the Lock/Unlock/Activate link

### 

### **Logs**

  - This was reported via [Yes We Hack](https://yeswehack.com/vulnerability-center/reports/679377) where the researcher assumed that the UI was correct and tried to send the backend requests which succeeded. Our [permission definition](https://github.com/opf/openproject/blob/419a89d6c728d6a2b2544f63b0d4bc55dc1f5a14/config/initializers/permissions.rb#L81-L90) in the code states clearly that we intend users with the `Manage Users` permission are allowed to change status.