User tests: Successful: Unsuccessful:
Pull Request for Issue
modfified queries to take care of category access level
Create/edit a category and set "super user" as Access Level
Create/edit an user with acess level different than "super suer" lets call "tester"
Create a new article in the category that should be unacessible for the test user
if you are logged on backend like "tester" user for your access level you can't see the articles in the categories categoria (it-IT) cause should be inacessible for your level, neither can create a new article in that category
you can see the articles from the category you cannot
you can see the article from the category you cannot
you can see the category tha you cannot
you cannot see the articles from the category that you lack of permission
Status | New | ⇒ | Pending |
Category | ⇒ | ACL com_categories |
Category | ACL com_categories | ⇒ | Administration com_categories com_content Libraries ACL |
@kalemanzi can you retest
now should be not possible to create a new article and assign the article to that test category.
Labels |
Added:
?
|
Well done! Almost there.
I've tested the article editor and it does not show the test category, it also does not show up in the category manager, so that bit is all good.
The last place I can see that it shows up now is in the search filters in article manager.
screen shot 2016-11-19 at 01 09 16
I have tested this item
Sorted! Thanks.
Problem here on a multilingual site:
A category set to SuperUsers access is not proposed anymore as a possible association.
I think that, as the user logged in does not have to edit that category or create an article in it, he should nevertheless have the possibility of associating it to the category he is editing.
If a parent category is set to SuperUsers access, its children categories are still usable.
Is that expected?
Note (unrelated to the patch):
As an administrator (not superuser) I can still assign the SuperUsers Access level to anything.
Result is that after saving anything with that access level, I can't see it anymore.
Would not that be an issue?
Problem here on a multilingual site:
A category set to SuperUsers access is not proposed anymore as a possible association.
I think that, as the user logged in does not have to edit that category or create an article in it, he should nevertheless have the possibility of associating it to the category he is editing.
correct
can we open a new issue for this ? (this pr works with monolanguage sites)
i'm not so sure what should be the best way to manage the user access level on association on multilingual:
@andrepereiradasilva what do you think about ?
If a parent category is set to SuperUsers access, its children categories are still usable.
Is that expected?
yes if the children level permits
for example:
if you are admin you have access at catA.1 and not at catA
Note (unrelated to the patch):
As an administrator (not superuser) I can still assign the SuperUsers Access level to anything.
Result is that after saving anything with that access level, I can't see it anymore.
Would not that be an issue?
even not, could be a way to implement some kind of workflow ??
I have tested this item
tested on a single language site
Status | Pending | ⇒ | Ready to Commit |
RTC
Milestone |
Added: |
Status | Ready to Commit | ⇒ | Fixed in Code Base |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-12-09 22:31:00 |
Closed_By | ⇒ | rdeutz |
I have tested this item🔴 unsuccessfully on 8ef78a8
I created a category called Test, and assigned it to Super Users.
I then created a test user as an Administrator, so I can login in the back end.
When logged in as test user and the patch is applied, it works as advertised in the article manager where it does not list articles assigned to the test category. The new test category also does not show up in the category manager.
However:
the following fails:
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12931.