[#11418] - [com_banners] User not allowed to core.manage? Use 403 php exception (instead of a 404 JError)
- Fixed in Code Base
- 14 Aug 2016
- Medium
- Build: staging
- # 11418
- Diff
- andrepereiradasilva:patch-9
- Success continuous-integration/travis-ci/pr The Travis CI build passed Details
- Success JTracker/HumanTestResults Human Test Results: 3 Successful 0 Failed. Details
User tests: Successful: Unsuccessful:
Pull Request for Improvement.
Summary of Changes
Replace com_banners exisiting 404 JError for a 403 php exception when the user does not have access to "Access Administration Interface" (core.manage).
Before
After
Testing Instructions
- Use latest staging
- Create a user and add it to "Administrator" group
- Go to com_banners and set "Access Administration Interface" (core.manage) to "Denied" for "Administrator" group
- Login with the Administrator user in a private window and go to /administrator/index.php?option=com_banners
- See the red message (Before)
- Apply patch
- Repeat step 4, you'll see now a 403 error (After).
If this change is ok i can do it for the other components that uses JError here.
joomla-cms-bot
- | Category | ⇒ | Administration Components |
| Status | New | ⇒ | Pending |
| Labels |
Added:
?
|
||
| Title |
|
||||||
yes i would prefer to, but can you hint on how to add a specific exception like NotAllowedException?
Well, if there isn't something in the standard SPL exceptions, just add a custom class like we have in the database API.
hum, doesn't seem to be any http://php.net/manual/en/spl.exceptions.php
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11418.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11418.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11418.
| Status | Pending | ⇒ | Ready to Commit |
RTC please
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11418.
| Labels |
Added:
?
|
||
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-08-14 16:00:56 |
| Closed_By | ⇒ | rdeutz |
| Labels |
Removed:
?
|
||
I would like to see a nicer error message, this one looks very technical. I also think to have some custom exceptions would be great. Merging it anyway because this is the way to go
what about:
You are not allowed to access this resource. Please contact your website administrator in order to get access to this resource.
or
You are not allowed to access this resource. Your website administrator can give you access to this resource just changing permissions.
people that is a language change nothing to do with this PR which porpose is to change the error to an exception.
Please make a PR for changing JERROR_ALERTNOAUTHOR if you feel the need.
I'd prefer a more specific Exception class but +1 on the idea.