[#27581] - [4.0] Wrong permission check for "Save2Menu"
- Closed
- 21 Jan 2020
- Medium
- Build: staging
- # 27581
Steps to reproduce the issue
Create a user which isn't allowed to create new menuitems, but is allowed to create new articles
Expected result
The button "Save2Menu" doesn't show in the article form
Actual result
Button shows
Additional comments
I haven't tested this but stumbled over the code while writing my own extension.
Code is in
joomla-cms/administrator/components/com_content/View/Article/HtmlView.php
Lines 188 to 190 in 8b5034f
If you look at it you see that the code just checks if the user is allowed to create in com_content. It should instead explicitely check against com_menus.
joomla-cms-bot
- | Labels |
Added:
?
|
||
save2copy can be done with $canDo->get('core.create') as currently done.
It's just the save2menu with needs an explicit check like
if ($user->authorise('core.create', 'com_menus.menu'))
{
$childBar->save('article.save2menu', Text::_('JTOOLBAR_SAVE_TO_MENU'));
}
I haven't had time yet to test it, but that's what I think is the correct check.
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-01-21 20:20:23 |
| Closed_By | ⇒ | Bakual |
Does it not need to be both, just for
save2menu,save2copyneeding onlycore.create?