? Success

User tests: Successful: Unsuccessful:

avatar alikon
alikon
17 Nov 2016

Pull Request for Issue

  • Article Manager don't respect category user level access.
  • search box category field don't respect category user level access.
  • possible to create a new article in an unaccessbile category

Summary of Changes

modfified queries to take care of category access level

Testing Instructions

Create/edit a category and set "super user" as Access Level
categories access level

Create/edit an user with acess level different than "super suer" lets call "tester"
user level

Create a new article in the category that should be unacessible for the test user

Expected result

if you are logged on backend like "tester" user for your access level you can't see the articles in the categories categoria (it-IT) cause should be inacessible for your level, neither can create a new article in that category

Actual result

you can see the articles from the category you cannot
error1

you can see the article from the category you cannot
erro2

you can see the category tha you cannot
error3

After patch

you cannot see the articles from the category that you lack of permission

avatar alikon alikon - open - 17 Nov 2016
avatar brianteeman brianteeman - change - 18 Nov 2016
Status New Pending
avatar brianteeman brianteeman - change - 18 Nov 2016
Category ACL com_categories
avatar kalemanzi kalemanzi - test_item - 18 Nov 2016 - Tested unsuccessfully
avatar kalemanzi
kalemanzi - comment - 18 Nov 2016

I have tested this item 🔴 unsuccessfully on 8ef78a8

I created a category called Test, and assigned it to Super Users.
I then created a test user as an Administrator, so I can login in the back end.

When logged in as test user and the patch is applied, it works as advertised in the article manager where it does not list articles assigned to the test category. The new test category also does not show up in the category manager.

However:
the following fails:

  • In the article manager, and using the search tools, there is still a choice to select the test category as a search filter option.
  • It's still possible to create a new article and assign the article to that test category.
    This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12931.
avatar joomla-cms-bot joomla-cms-bot - change - 18 Nov 2016
Category ACL com_categories Administration com_categories com_content Libraries ACL
avatar alikon
alikon - comment - 18 Nov 2016

@kalemanzi can you retest
now should be not possible to create a new article and assign the article to that test category.
erro4

avatar alikon alikon - change - 18 Nov 2016
The description was changed
Labels Added: ?
avatar alikon alikon - edited - 18 Nov 2016
avatar alikon alikon - change - 18 Nov 2016
The description was changed
avatar alikon alikon - edited - 18 Nov 2016
avatar alikon alikon - change - 18 Nov 2016
The description was changed
avatar alikon alikon - edited - 18 Nov 2016
avatar kalemanzi
kalemanzi - comment - 19 Nov 2016

Well done! Almost there.
I've tested the article editor and it does not show the test category, it also does not show up in the category manager, so that bit is all good.

The last place I can see that it shows up now is in the search filters in article manager.
screen shot 2016-11-19 at 01 09 16


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12931.

avatar kalemanzi
kalemanzi - comment - 20 Nov 2016

I have tested this item ✅ successfully on 09b0006

Sorted! Thanks.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12931.

avatar kalemanzi kalemanzi - test_item - 20 Nov 2016 - Tested successfully
avatar infograf768
infograf768 - comment - 21 Nov 2016

Problem here on a multilingual site:
A category set to SuperUsers access is not proposed anymore as a possible association.
I think that, as the user logged in does not have to edit that category or create an article in it, he should nevertheless have the possibility of associating it to the category he is editing.

If a parent category is set to SuperUsers access, its children categories are still usable.
Is that expected?

Note (unrelated to the patch):
As an administrator (not superuser) I can still assign the SuperUsers Access level to anything.
Result is that after saving anything with that access level, I can't see it anymore.
Would not that be an issue?

avatar alikon
alikon - comment - 23 Nov 2016

Problem here on a multilingual site:
A category set to SuperUsers access is not proposed anymore as a possible association.
I think that, as the user logged in does not have to edit that category or create an article in it, he should nevertheless have the possibility of associating it to the category he is editing.

correct
can we open a new issue for this ? (this pr works with monolanguage sites)
i'm not so sure what should be the best way to manage the user access level on association on multilingual:

@andrepereiradasilva what do you think about ?

If a parent category is set to SuperUsers access, its children categories are still usable.
Is that expected?

yes if the children level permits

for example:

  • catA - superuser -- catA.1 - admin

if you are admin you have access at catA.1 and not at catA

Note (unrelated to the patch):
As an administrator (not superuser) I can still assign the SuperUsers Access level to anything.
Result is that after saving anything with that access level, I can't see it anymore.
Would not that be an issue?

even not, could be a way to implement some kind of workflow ??

avatar brianteeman
brianteeman - comment - 6 Dec 2016

I have tested this item ✅ successfully on 09b0006

tested on a single language site


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12931.

avatar brianteeman brianteeman - test_item - 6 Dec 2016 - Tested successfully
avatar brianteeman brianteeman - change - 6 Dec 2016
Status Pending Ready to Commit
avatar brianteeman
brianteeman - comment - 6 Dec 2016

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12931.

avatar brianteeman brianteeman - change - 6 Dec 2016
Milestone Added:
avatar rdeutz rdeutz - change - 9 Dec 2016
Status Ready to Commit Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2016-12-09 22:31:00
Closed_By rdeutz
avatar rdeutz rdeutz - close - 9 Dec 2016
avatar rdeutz rdeutz - merge - 9 Dec 2016
avatar rdeutz rdeutz - reference | a7ae028 - 9 Dec 16
avatar rdeutz rdeutz - merge - 9 Dec 2016
avatar rdeutz rdeutz - close - 9 Dec 2016
avatar zero-24 zero-24 - head_ref_deleted - 10 Dec 2016
avatar cpfeifer cpfeifer - reference | fb3e6ba - 22 Dec 16

Add a Comment

Login with GitHub to post a comment