? Pending

User tests: Successful: Unsuccessful:

avatar mohamed-karam
mohamed-karam
27 Apr 2019

Pull Request for Issue #22884 .

Summary of Changes

Added a condition if user is not admin before filtering by access level

Testing Instructions

Instructions copied from issue by franz-wohlkoenig:

  • Set the status of an article category to Guest,
  • add a Guest status article to the category,
  • use the Search Tool in Article Manager to filter for the category in Select Category.

Expected result

The Guest status article category to show in the results.

avatar mohamed-karam mohamed-karam - open - 27 Apr 2019
avatar mohamed-karam mohamed-karam - change - 27 Apr 2019
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 27 Apr 2019
Category Libraries
avatar franz-wohlkoenig franz-wohlkoenig - change - 27 Apr 2019
Title
This fixes #22884, Added filtering by access level if user is not admin
Added filtering by access level if user is not admin
avatar franz-wohlkoenig franz-wohlkoenig - edited - 27 Apr 2019
avatar franz-wohlkoenig franz-wohlkoenig - change - 28 Apr 2019
The description was changed
avatar franz-wohlkoenig franz-wohlkoenig - edited - 28 Apr 2019
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 28 Apr 2019

I have tested this item successfully on 914f5ca


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/24741.

avatar franz-wohlkoenig franz-wohlkoenig - test_item - 28 Apr 2019 - Tested successfully
avatar brianteeman
brianteeman - comment - 28 Apr 2019

This looks wrong to me. The solution is in the screenshot here #22884 (comment)

avatar mohamed-karam
mohamed-karam - comment - 28 Apr 2019

@brianteeman Shouldn't the superuser have access over any group? This behavior exists in other components

if (!$user->authorise('core.admin'))

if (!$user->authorise('core.admin'))

avatar mbabker
mbabker - comment - 28 Apr 2019

Groups which are used for ACL are different from the viewing access levels and the two systems should not be making assumptions based on the other. As I've said about a thousand times now, someone really just needs to sit down and refactor the code if you really want the viewing access level logic to behave differently based on the ACL code and stop plugging in random if (!Factory::getUser()->authorise('core.admin')) {} checks because that is not fixing the problem, that is just working around it.

avatar HLeithner
HLeithner - comment - 29 Apr 2019

@mbabker could you please make a outline what you suggest or provide a link to a solution?

avatar mbabker
mbabker - comment - 29 Apr 2019

Since there is this weird desire to couple the viewing access level system to the ACL system (two completely unrelated systems) and only for super users, a solution I have mentioned in the past is to adapt Joomla\CMS\User\User::getAuthorisedViewLevels() and its internals to assign all view levels to super users.

avatar mbabker
mbabker - comment - 29 Apr 2019

Other solutions include the deprecation of the viewing access level system in favor of a core.view or core.read ACL permission and have everything reside in one system, but given the ACL system's lack of scalability, this probably isn't something that will work well in the long run without a major refactoring of the ACL system.

avatar HLeithner
HLeithner - comment - 29 Apr 2019

ok, the access level is faster as the ACL I think, so returning all access levels for the super users would be the solution with less negativ impact. Maybe we find someone that could do this for J4.

I would close this here because its the wrong solution.

avatar HLeithner HLeithner - change - 29 Apr 2019
Status Pending Closed
Closed_Date 0000-00-00 00:00:00 2019-04-29 14:36:28
Closed_By HLeithner
Labels Added: ?
avatar HLeithner HLeithner - close - 29 Apr 2019

Add a Comment

Login with GitHub to post a comment