No Code Attached Yet
avatar pjdevries
pjdevries
31 Dec 2021

Steps to reproduce the issue

In a virgin J4.0.5 site:

  • Create a Registered user.
  • Create a category and give the group the user belongs to the following permissions for that category: Create, Delete, Edit State & Edit Own.
  • Create a menu item of type 'Category List'.
  • Login in the front end as the new user.
  • Navigate to the Category List.
  • Click 'New Article'.
  • Enter at least the title and click 'Save'.

Expected result

The new article being succesfully created and showing up in the Category List.

Actual result

A 404 with error message: Invalid field: Start Featured

System information (as much as possible)

Joomla! 4.0.5

Additional comments

I traced the cause of the error to line 501 of the front end article model Joomla\Component\Content\Administrator\Model\ArticleModel (administrator/components/com_content/src/Model/ArticleModel.php). That line and preceeding comment read:

// Get ID of the article from input, for frontend, we use a_id while backend uses id
$articleIdFromInput = (int) $app->input->getInt('a_id') ?: $app->input->getInt('id', 0);

First of all I wonder why the back end id is checked in a front end model.
Secondly, the id obtained from $app->input can apparently contain a value other than the record id (didn't check but it looks like the category id). This sets the $articleIdFromInput to a non 0 value, whereas it should be 0 for new articles. The result is that permission, to edit certain attributes of the the record, are checked against a wrong or invalid record id, eventually resulting in the above mentioned error or unjustified acceptation or rejection of the record.

EDIT: I removed the proposed solution. Thanx to @ReLater who pointed out my stupid mistake.

Maybe this is a better approach:

$articleIdFromInput = $app->isClient('site')
			? (int) $app->input->getInt('a_id', 0) 
			: $app->input->getInt('id', 0);
avatar pjdevries pjdevries - open - 31 Dec 2021
avatar joomla-cms-bot joomla-cms-bot - change - 31 Dec 2021
Labels Added: No Code Attached Yet
avatar joomla-cms-bot joomla-cms-bot - labeled - 31 Dec 2021
avatar ReLater
ReLater - comment - 31 Dec 2021

First of all I wonder why the back end id is checked in a front end model.

Because the model is used in frontend and backend. Therefore the line checks first for a frontend ID that normally uses a_id not id inside the edit URL. If a_id not provided check for id which is normally the article id in backend inside the edit URL.

Example for new article in frontend: ?view=form&a_id=0&layout=edit&catid=2&return=xyz

avatar pjdevries
pjdevries - comment - 31 Dec 2021

Like I mentioned, the problem appears in the front end ArticleModel. Why would that model be used in the back end? Anyhow, the problem exists, is reproducible and can be solved with the proposed modification.

avatar ReLater
ReLater - comment - 31 Dec 2021

Your pointing to

Joomla\Component\Content\ Administrator \Model\ArticleModel ( administrator /components/com_content/src/Model/ArticleModel.php).

in your opening post and I was just answering 1 question BTW.

I didn't want to discuss the main issue. Haven't tested.

avatar pjdevries
pjdevries - comment - 31 Dec 2021

@ReLater You are absolutely right and I feel ashamed for my inconsiderate response. I apologize and will correct the mistake.

avatar pjdevries pjdevries - change - 31 Dec 2021
The description was changed
avatar pjdevries pjdevries - edited - 31 Dec 2021
avatar pjdevries
pjdevries - comment - 31 Dec 2021

Not an excuse, but I was completely wrong footed because I was creating a new article in the front end and did not notice it was actually the back end model in which the error occurred. Thanx to @ReLater for pointing that out.

The error is still real though. However, my suggested solution wasn't, so I removed it from the issue.

avatar pjdevries pjdevries - change - 31 Dec 2021
The description was changed
avatar pjdevries pjdevries - edited - 31 Dec 2021
avatar joomdonation
joomdonation - comment - 31 Dec 2021

@pjdevries Your better approach is right (except (int) type casting is not needed). Could you please make a PR with your propose code?

avatar pjdevries
pjdevries - comment - 31 Dec 2021

@joomdonation Unfortunately I can not spare the time to create PR's. They always take unforeseen more time than anticipated and I'm not able to deal with that right now.

avatar alikon alikon - change - 3 Jan 2022
Status New Closed
Closed_Date 0000-00-00 00:00:00 2022-01-03 08:23:25
Closed_By alikon
avatar alikon alikon - close - 3 Jan 2022
avatar alikon
alikon - comment - 3 Jan 2022

please test #36542

avatar pjdevries
pjdevries - comment - 3 Jan 2022

I tested and approved.

Add a Comment

Login with GitHub to post a comment