[#15518] - [com_fields] A frontend Author has no ACL to set new media in com_fields
- Closed
- 19 Aug 2017
- Medium
- Build: master
- # 15518
Steps to reproduce the issue
Install Joomla 3.7.0
Create a custom field of type media with full defaults
Login to the front end as an Author, ready to submit your new content...
Expected result
That a front end "Author" (A User with "Author group membership") should be able to select some media in the custom field
By default, the ACL for "Edit Custom Field Value" is inherited, which is denied.
Actual result
When submitting content on the frontend, an Author can only see the default value (or nothing) and cannot click the missing select button to launch a modal to select some media.
One would assume that an Author should be able to select something for this field?
| Labels |
Added:
?
|
||
| Title |
|
||||||
| Title |
|
||||||
| Title |
|
||||||
| Category | ⇒ | ACL com_fields |
| Title |
|
||||||
| Status | New | ⇒ | Information Required |
From a security point of view, I would go the way that an admin needs to actively activate the right permissions for non super admins. So I would leave it as it is. But I'm just a developer and not a security expert.
You could set the global ACL settings for this action in the database. We can adjust that for new installations. But we can't do it for upgraded sites.
| Status | Information Required | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-08-19 12:17:26 |
| Closed_By | ⇒ | franz-wohlkoenig |
closed as stated above.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15518.
Set to "closed" on behalf of @franz-wohlkoenig by The JTracker Application at issues.joomla.org/joomla-cms/15518
Yes I know you could mess with the ACL to achieve this, but we should be providing sound defaults for the shipped default usergroups for each type of field in com_fields