No Code Attached Yet J3 Issue
avatar alex7r
alex7r
25 Jul 2016

Steps to reproduce the issue

If view named "learning_path" or "lpath"
and asset name used in JTable is component.lp.id

Expected result

I'd like to avoid issues with getting my site down every time I change permission

Actual result

/media/system/js/permissions.min.js searches for asset name component.view.id which results in component.learning_path.id instead of component.lp.id
and new asset record added to table with parent_id = 0

Additional comments

May be solution is allowing to manipulate with asset name via js, allowing to influence everything except the component. for security and extensions encapsulation reasons.

var asset_name_postfix_var = getUrlParam("view");

In /media/system/js/permissions.min.js use:

var asset_name = "component."+asset_name_postfix_var;
avatar alex7r alex7r - open - 25 Jul 2016
avatar alex7r
alex7r - comment - 25 Jul 2016

Temp solution

For those who might run into this issue here is solution for this kind of situation:

var initialgetUrlParam = getUrlParam;
getUrlParam = function(){
    if(arguments[0] == 'view'){
        return 'lp';
    }else{
        return initialgetUrlParam.apply(document, arguments);
    }
}

And may be

var initialGetElementById = document.getElementById;
document.getElementById = function(){
    if(arguments[0] == 'jform_title'){
        return initialGetElementById.apply(document, ['jform_c_title']);
    }else{
        return initialGetElementById.apply(document, arguments);
    }
}

If you have c_title for some reason instead of title.
But remember: having anything_title instead of title is a BAD HABBIT

avatar alex7r alex7r - reference | - 25 Jul 16
avatar brianteeman brianteeman - change - 25 Jul 2016
Category JavaScript
avatar andrepereiradasilva
andrepereiradasilva - comment - 25 Jul 2016

IMHO, you're right. It's not correct to use the url parameters to determine the asset key.

unless i'm mistaken, it should use the typeAlias property of the component item model.

BTW in 3.6.0 there is no /media/system/js/permissions.min.js file. The files are:

avatar ggppdk
ggppdk - comment - 25 Jul 2016

1 . For requirement in JS to have 'jform_title', for forms that do not have, i am adding a hidden empty field with id:

jform_title
  • you can take time to make a PR i promise to test it

2 . For the view naming issue, i am manipulating the posted data ... when needed ... to work around it, i don't know if you would like to make a PR for this too, i will test too

3 . Finally, about:

and new asset record added to table with parent_id = 0

if 2 assets with parent_id = 0, are created (due to software bugs), then ACL no longer works

  • there should be a check somewhere if the above happens for any reason , and e.g. delete all extra assets with parent_id = 0 and wrong name, if you make a PR for this, i will test too
avatar mbabker
mbabker - comment - 25 Jul 2016

For requirement in JS to have 'jform_title', i am adding a hidden empty field:

Why? Why is core creating hardcoded requirements to explicit form fields being present? Why are our JavaScript APIs not open to have these things customized as needed? We're creating a lot more JavaScript based integrations in core and we're making a lot of the same mistakes as exist with our PHP code, creating hardcoded requirements on certain conventions without introducing mechanisms to change those hardcoded values for scenarios that they don't exist in.

avatar brianteeman brianteeman - change - 27 Jul 2016
Labels Added: ?
avatar brianteeman brianteeman - change - 28 Jul 2016
Labels Removed: ?
avatar brianteeman brianteeman - change - 28 Jul 2016
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - change - 28 Jul 2016
The description was changed
avatar joomla-cms-bot joomla-cms-bot - edited - 28 Jul 2016
avatar franz-wohlkoenig franz-wohlkoenig - change - 6 Apr 2017
Status New Needs Review
avatar brianteeman brianteeman - change - 25 Mar 2018
Labels Added: J3 Issue
avatar brianteeman brianteeman - labeled - 25 Mar 2018
avatar brianteeman
brianteeman - comment - 23 Aug 2022

Thank you for raising this issue.

Joomla 3 is now in security only mode with no further bug fixes or new features.

As this issue doesn't relate to Joomla 4 it will now been closed.

If we are mistaken and this does apply to Joomla 4 please open a new issue (and reference this one if you wish) with updated details for testing in Joomla 4
cc @zero-24

avatar zero-24 zero-24 - change - 23 Aug 2022
Status Needs Review Closed
Closed_Date 0000-00-00 00:00:00 2022-08-23 10:13:31
Closed_By zero-24
Labels Added: No Code Attached Yet
Removed: ?
avatar zero-24 zero-24 - close - 23 Aug 2022

Add a Comment

Login with GitHub to post a comment