Feeling Lucky
?
[#26606] - [4.0] Custom User Group - Component Dashboard
- Closed
- 2 Feb 2020
- Medium
- Build: Amani
- # 26606
Steps to reproduce the issue
Create a custom user group, say Branch, as a child of Registered. Add that group to the Special Access Level. Give the group all the Admin permissions except Configure ACL & Options to one component via Global Configuration. Create a user in the Registered and Branch group. Login as that user.
Expected result
The user should have access to that one component only. Works but ...
Actual result
The Component dashboard shows all components. All of the links lead to a 'You don't have permission ...' error. The title bar has Version and Private message icons (wrong default permissions?)
System information (as much as possible)
Joomla 4.11Alpha + PHP 7.2.5 + MySQL 5.6.34 on MacBook Pro set up for development.
Additional comments
Not a show-stopper, just an annoyance!
Votes
# of Users Experiencing Issue
1/1
Average Importance Score
4.00
joomla-cms-bot
- | Title |
|
||||||
brianteeman
- | Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-02-02 22:24:38 |
| Closed_By | ⇒ | brianteeman |
I have a similar situation. Custom group derived from Public, Special Access Level, global permissions for site and admin login.
At J3 I was able to grant permission for options to my extension only for custom user group by setting core.manage or core.options at my extension options. At the backend this group only sees this extension, options of this extension are manageable. I didn't have to give other permissions than core.login.admin at global configuration.
This works, because components/com_config/controller/display.php checks access by
if (!JFactory::getUser()->authorise('core.admin', $component) && !JFactory::getUser()->authorise('core.options', $component))at public function execute(), where $component is my extension.
At J4 restriction to only see my extension works as expected with same settings as at J3, but I have to grant core.manage of global configuration to be able to edit options of my extension. But then my custom group sees lot more at the backend and is able to do much more things than wanted. This is, because libraries/src/Dispatcher/ComponentDispatcher.php checks access by
if ($this->app->isClient('administrator') && !$this->app->getIdentity()-> authorise('core.manage', $this->option))at protected function checkAccess(), where $this->option is com_config.
If I change this to
if ($this->app->isClient('administrator') && !$this->app->getIdentity()-> authorise('core.manage', $this->option) && !$this->app->getIdentity()-> authorise('core.options', $this->option))and grant core.options instead of core.manage of global configuration to my custom user group, then I get the wanted behaviour, but I can't estimate if there are unwanted side effects caused by this change.
Is my approach to restrict access to my extension only completely wrong for J4 or would my change to this core file make sense in general?
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/26606.