C
Chris Stone
Desired Result / Issue Resolution:
"Manage Smart Lists" should not be affected at all by the "Settings" toggle under User Permissions. Instead, it should be affected by the "Contacts" toggle in User Permissions.
--------------------
Issue Description:
Currently, when the "Settings" toggle is turned [OFF] in a User's Permissions, the "Manage Smart Lists" sub-page in the "Contacts" dashboard disappears. This prevents the User from being able to edit, share, or delete their own "Smart List" / "Saved Filters" in the "Contacts" dashboard view.
The issue is compounded because a "Smart List", once created, is not accessible to anyone but the User who created it. Not even Account or Agency Admins can access a User's "Smart List" / "Saved Filter" by default. Should the User want to delete their own "Smart Lists", in this scenario, they would be prevented from doing so - unless the User Permission for "Settings" was turned [ON] (which is NOT acceptable due to what the actual Settings menu includes by default, and a "User" should not have access to).
STEPS TO REPLICATE ISSUE:
  1. Create new Team Member of type: "User".
  2. Open an incognito browser tab and log into the SaaS with the User account's credentials.
  3. In a different browser tab where you are logged in as an Admin or Agency Admin, turn [OFF] the User Permission "Settings" toggle for the 'test User' you logged in with in Step 2. Save the changes to the User.
  4. Switch to the incognito tab from Step 2 where you are logged in as the "User". Refresh the page. Navigate to Contacts in the left menu. Notice you do not have the "Manage Smart Lists" tab/page/section. Now create a new "Smart List" / "Saved Filter". Make sure that shows up next to where the "All" button is at the top of your Contact List. Notice you have no way to delete this newly-created "Smart List".
  5. In the other browser tab where you are logged in as an Admin / Agency Admin, go to the "Contacts" area. Notice that the "Smart List" you created in Step 4 is not shown. (It is only shown to the "User" that created it.) This means you cannot delete or manage that User's "Smart List".
(Apparently, "Smart Lists" are only seen by the User/Admin who created it. That is, until they share it with others in the same Location / Sub-account by going into the "Manage Smart Lists" area and clicking the "Share" icon & choosing some options.)
Security Risk:
Most Admins want to manage their Users' access to potentially confidential and/or sensitive information & controls within the HighLevel Location / Sub-account.
Should a User need help removing / deleting any "Smart List" from their account, an Admin would need to turn [ON] the "Settings" toggle in "User Permissions".
This would expose the confidential and/or sensitive information & controls within the HighLevel Location / Sub-account while allowing the User to also gain access to the necessary "Manage Smart Lists" area found in "Contacts" giving the User the ability to delete (or manage) whatever "Smart Lists" they wanted to.