Issue

An editor allowed to manage some categories and all articles belonging to these categories is also allowed to set the "featured" flag for some of these articles, but he is not able to change the ordering of these featured articles (assume that there is a menu item showing the featured articles within those categories the editor is allowed to manage).

Currently you need the "Edit State" permission for all articles in order to rearrange featured articles, even if you have the "Edit State" permission for all these featured articles.

Use Case

Within a sports club with many divisions we have one editor for each division. There is one top-level category for each division and the editor responsible for a division can administrate this top-level category such that he can add sub-categories when needed, create articles, make these articles featured or unfeatured. There is a separate menu for each sports division with a menu item displaying all featured articles of that division. Each editor is allowed to log in to the backend.

The editors are currently not able to change the ordering of these featured articles. They open the page with the featured articles in the backend, select their categories, set the sort ordering to "Ordering ascending" and rearrange the featured articles by moving them with the mouse to the desired place. At first sight everything looks fine in the backend and there is no error message that changing the order was not possible, but if they reload the respective page in the frontend (or reload the backend page with the featured article list) they get the previous order.

Testing instructions

For testing my PR you need a current Joomla installation with the sample data installed.

Preparation

Create a new user group with the name "Park Site Authors", the parent user group is "Registered".

Set the following permissions for this new user group:

• in the global configuration: Administrator Login, Edit Own
• for articles: Administrative Access
• for the category "Park Site": Create, Delete, Edit, Edit State

Add this new user group to the access level "Special".

Finally create a new user with the name "Park Site Author", login "psauthor", password ..., mail ... and assign the user group "Park Site Authors" to this user (in doing so you might remove the default user group "Registered").

Note: the editors in the sports club have additional permissions beside those given above (like access to the media section), but these permissions do not interfere with the issue in this PR.

If you think you've seen this setup before - this is true, see PR #19822.

Status Quo

Log in as user "psauthor" and go to Articles. Open the search tools and select the "Animals" category (this is a sub-sub-category of the "Park Site" category). You should now see 4 articles and you should have the right to change them. Make three of them to featured articles.

Next go to Articles: Featured. You should now see the three articles in the "Animals" category and another four articles. Open the search tools and select the "Animals" category. Now you should see only the three featured articles from the "Animals" category. Change the sort ordering to "Ordering ascending".

Rearrange the featured articles, e.g. by moving the first featured article in the list to the end of this list. Note that the list now shows the new ordering and that no error message is displayed.

Reload the page and you'll see that the order of the featured articles is the same as before you rearranged the featured articles.

Changes

First apply this PR.

Then log in as user "psauthor" and repeat all steps described above including reloading the featured articles page. Now the new order of the featured articles is permanent.

A Final Note Regarding Implementation

In investigating this issue I saw that the method canEditState() in administrator/components/com_content/models/article.php is finally executed on behalf of the method saveorder() in libraries/src/MVC/Model/AdminModel.php in order to check whether the user may edit the state of the given object (featured article), but this method works only for rows from the #__content table.

But here it gets rows from the #__content_frontpage table where neither a column id nor a column catid exists. So this method finally calls the parent method which checks whether the user has the "Edit State" permission for all articles.

I copied the method canEditState() from .../article.php to .../feature.php, changed id into content_id and removed the category check (catid field) since this field doesn't exist in the #__content_frontpage table.