the problem is also for "Article" button in the editor
yes
elseif ($input->get('view') === 'articles' && $input->get('layout') === 'modal')
{
if (!$user->authorise('core.edit', 'com_content'))
{
JFactory::getApplication()->enqueueMessage(JText::_('JERROR_ALERTNOAUTHOR'), 'warning');
return;
}
}
in the same file
ROOT/components/com_content/content.php
You do PR or I do?
hmm, wondering now if that was on purpose...
Did it work OK before 3.6.2?
This code was added in 3.4.5
dca641f#diff-35390bcd97e9f612d6fc06ea874aa22a
I think it should be like this:
core.edit
and item id different than 0: Allowedcore.edit.own
, item created by user and item id different than 0: Allowedcore.create
and item id equal to 0: Allowedand IMHO this should be applied to all components with modals.
But it's better for @wilsonge to confirm there is no problem with that.
Also the warning should IMHO be a 403 exception
throw new JAccessExceptionNotallowed(JText::_('JERROR_ALERTNOAUTHOR'), 403);
For your info, that code was added for security reasons at the time.
One of the issues with letting people display the modals with Create or Edit own only is that they will be able to see in the modals titles of stuff they may not be allowed to see (access restricted): Articles, menu items, contacts.
For pagebreak, indeed, no use imho to restrict to edit.
For pagebreak, indeed, no use imho to restrict to edit.
Yes, and this is issue is a kind of duplicate,
There is already a discussion here: #10653
Please see my comment: #10653 (comment)
Please see also
#12321 (comment)
Closed as we have a PR - thanks
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-10-09 09:24:33 |
Closed_By | ⇒ | brianteeman |
Looks like the permissions are only set to edit and not create.
That should be easy to correct