can we please add the tag for release blocker to this one?

At @mbabker request, taking off check for module access

The check is right, it should just be in components/com_modules/modules.php.

On it

Done. Please test asap and mark results on issues.joomla.org

I have tested this item ? unsuccessfully on 8918b59

The sec issue still exists.

Get the list of modules without login

go to the login screen
see the html code for the token
use this URL: http://example.org/index.php?option=com_modules&view=modules&layout=modal&tmpl=component&editor=jform_articletext&=1

@infograf768 check infograf768#44

@mbabker

It's totally possible to have a group with create permissions without edit, so you're more likely breaking something than fixing it (compared to 3.6.2 which checks core.edit).

The aim of all this was to let authors use these xtds. They do not have edit permissions which prevented them from using the xtds in front-end.
One could indeed have edit permissions without create, but this is very unlikely.

Therefore the main difference with 3.6.2 is that authors now can see the lists, use pagebreak and that the modules modal is access protected.

I have now corrected the PR for typo (module(s) and too much vars.
I propose to go with it and fine grain ACL in 3.7.

I have tested this item ✅ successfully on 71b5544

Works here. Just a cosmetic change that the error message should be a error and not a warning. But other things works great!

Warning is what we got before
https://github.com/joomla/joomla-cms/pull/12353/files#diff-35390bcd97e9f612d6fc06ea874aa22aL22

Let's fine tune all this in 3.7 :)

?

The aim of all this was to let authors use these xtds. They do not have edit permissions which prevented them from using the xtds in front-end.

If every site uses the default ACL system then thinking in that structure is valid. Except not every site uses the default ACL structure. Many of the sites I manage have most of the default groups deleted and custom groups added. In general we have to think beyond the ACL groups that are shipped as part of our dataset and look at the actual permissions when we are doing things like this.