Feeling Lucky
?
?
[#17840] - Fix allowedit for field group, only use component ACL if group ID is zero (new record)
- Fixed in Code Base
- 25 Sep 2017
- Medium
- Build: staging
- # 17840
- Diff
- ggppdk:patch-42
User tests: Successful: Unsuccessful:
Same fix as fix that had been applied here in the past to the article controller :
This is minor security issue,
if user than has "edit" on fields component, is denied editing configuration of a specific field group,
then user will still be able to edit the field group's configuration
Summary of Changes
Testing Instructions
Expected result
Actual result
Documentation Changes Required
joomla-cms-bot
- | Category | ⇒ | Administration com_fields |
| Status | New | ⇒ | Pending |
| Title |
|
||||||
Sieger66
- comment
- 12 Sep 2017
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/17840.
| Status | Pending | ⇒ | Ready to Commit |
franz-wohlkoenig
- comment
- 12 Sep 2017
RTC after two successful tests.
mbabker
- | Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-09-25 11:42:00 |
| Closed_By | ⇒ | mbabker | |
| Labels |
Added:
?
?
|
||
I have tested this item✅ successfully on 4ee0e26
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/17840.