@ggppdk
Can you confirm?

Yes, confirmed, tested and code review, edit not possible despite

the user both having core.edit.own on category and owning the contact record

Looks like we need new permissions in the access.xml and changes in the controller for allowEdit() as it only takes care of category edit.
For newsfeeds, all code is missing. As well for weblinks.

Again in this case, it is not a security issue (it is not because the ACL check on core.edit of category asset forces a return ! if category id is non zero), but a usability issue,

• the owners should be allowed to edit the records, if having core.edit.own, but this is not checked

I can see why this was not added, it is because

• contacts, newsfeed, weblinks do not have individual assets

Thus you need core.edit.own checking that is a little different than e.g. articles
1. Check core.edit.own on their category (instead of the contact, weblink, newsfeed record)
2. Check owner (created_by property==current_user_id) as they do have this property

This :
https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_contact/controllers/contact.php#L60-L78

Should be something like:

$recordId = (int) isset($data[$key]) ? $data[$key] : 0;

// New record (id:0) only in this case fallback to component permissions !!
if (!$recordId)
{
    parent::allowEdit($data, $key);
}

// Need to do a lookup from the model.
$record = $this->getModel()->getItem($recordId);

// Not found or empty category
if (!$record || empty($record->catid))
{
    return false;
}

$categoryId = $record->catid;

// First test if having core.edit on the record's category
// If individual asset is added in the future then we need to check on the record asset itself)
if ($user->authorise('core.edit', $this->option . '.category.' . $categoryId))
{
    return true;
}

// Not having core.edit, test core.edit.own on the category (again because no individual asset)
if ($user->authorise('core.edit.own', $this->option . '.category.' . $categoryId))
{
    // If the owner matches 'me' then permission is granted.
    return $record->created_by == JFactory::getUser()->id;
}

return false;

I did not say it was a security issue. If it had been I would not have posted here.
I discovered these issues while working on the multilingual GSOC project

your code does not work here.

your code does not work here.

yes you are right,
(but i did contribute some time to test the issue and propose code)

someone should take time to make a PR and then answer it, update it, etc etc .... and it will work, (it may need some small corrections)

i can do next days, (since this is not urgent and there are 3 controllers to patch), otherwise someone else can take time to do it now

for newsfeeds, needs more work as even created_by is not fetched...

See the code above

Propably all of the code is same in all controllers:
This gets a model instance to get the owner id

            // Need to do a lookup from the model.
            $record = $this->getModel()->getItem($recordId);

            if (empty($record))
            {
                return false;
            }

            $ownerId = $record->created_by;

I mean here:
https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_newsfeeds/models/newsfeeds.php#L153-L160

I am not sure (without testing) but we speak of the
allowEdit() method
of the singular controllers:

components\com_contacts\controllers\contact.php
components\com_newsfeeds\controllers\newsfeed.php
components\com_weblinks\controllers\weblink.php

I think

$record = $this->getModel()->getItem($recordId);

will use models:
components\com_contacts\models\contact.php
components\com_newsfeeds\models\newsfeed.php
components\com_weblinks\models\weblink.php

that already retrieve the created_by property ?

without a correction in the model, we also get errors in the manager

without a correction in the model, we also get errors in the manager

aaa yes you are right we need to get the created_by property to be retrieved by these plural models,

• for usage in "canEdit" calculation inside default.php of the backend lists

i see it is incomplete too only checking core.edit

e.g.
https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_newsfeeds/views/newsfeeds/tmpl/default.php#L98

$canEdit    = $user->authorise('core.edit',       'com_newsfeeds.category.' . $item->catid);

should be:

$canEdit = $user->authorise('core.edit',       'com_newsfeeds.category.' . $item->catid) ||
    (
        $user->authorise('core.edit.edit', 'com_newsfeeds.category.' . $item->catid) &&
        $item->created_by==$user->id
    );

I suggest, if you can help, to solve the issue first with com_contacts with a specific PR (or first propose a .diff here).
Then it should be easy to go all over newsfeeds and implement it wherever needed.

Ok, this seems straghtforward, I will do today 1 PR for the 3 controllers and the 3 listing templates (i will update plurar models too), i think it will be much more time to test this that to code it)), since what needs to be done was discussed here

PR for newsfeeds is here #11502 please test

PR for com_contact #11503

weblinks PR joomla-extensions/weblinks#255

cam be closed as there are 3 PR to test: #11502 | #11503 | joomla-extensions/weblinks#255

Closed as we have PRs