[#36719] - [5.2] Fix Permissions for Manually Running Scheduled Tasks
- Fixed in Code Base
- 18 Jan 2025
- Medium
- Build: 4.1-dev
- # 36719
- Diff
- ditsuke:fix-disabled-run-task-btn-on-no-auth-36677
User tests: Successful: Unsuccessful:
Pull Request for Issue #36677.
Summary of Changes
- Explicitly disables the "run task" button on insufficient authorization.
- Adds tooltip to give context on disabling the button.
- Change default permission level for running tasks/grant access to creator.
- Prevent manual runs from being publicly accessible regardless of permission levels. Ref: #36453#issuecomment-1001793962 / @PhilETaylor
Testing Instructions
- Create a new task with an administrator (not superuser) account.
- Still as administrator, try to run it from the Scheduled tasks manager.
- Try to run other tasks created by the super user.
- Login as super user.
- Check that you can run all tasks.
- Thrash some task.
- Check the trashed tasks.
Actual result BEFORE applying this Pull Request
As administrator (not superuser), there is no indication that the user is not authorized to run the task. The button is usable.
In all cases there is an error message.
Only a super user can run tasks.
Expected result AFTER applying this Pull Request
As administrator (not superuser):
- The button is enabled for tasks created by yourself and you can run these tasks.
- The button is disabled for tasks which were created by the super user (.e.g those from a new installation). Reason for being disabled is available through a tooltip on hover.
As super user buttons of all tasks are enabled, and you can run these tasks.
When a task is trashed, the button is disabled, and a tool tip shows the reason.
Documentation Changes Required
N/A
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration Language & Strings |
| Labels |
Added:
Language Change
?
|
||
How can it make sense for a user to be able to create a new task and setup lazy loading etc but not be able to run the task directly
Definitely, now that I think of it the creator should be able to run them manually as a default. I'll work on enabling that behavior before opening this PR.
Possibly need a new permission for that "Edit own"
| Category | Administration Language & Strings | ⇒ | Administration Language & Strings Front End Plugins |
This pull request has automatically rebased to 4.2-dev.
This pull request has been automatically rebased to 4.3-dev.
This pull request has been automatically rebased to 4.4-dev.
| Title |
|
||||||
This pull request has been automatically rebased to 5.2-dev.
| Title |
|
||||||
Can you please fix the conflicts?
| Labels |
Added:
bug
PR-4.4-dev
PR-5.2-dev
Removed: ? |
||
| Labels |
Removed:
PR-4.4-dev
|
||
I have tested this item ✅ successfully on eb813f6
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.
I have tested this item 🔴 unsuccessfully on eb813f6
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.
I've tested on J5.2.3 with a user belonging to user group "Administrator".
- Without the patch applied, I was able to click on an existing task, but the task showed an error.
- With the patch applied, the task execution button of the existing task were "greyed" out and showed a tooltip "Not authorized".
- But with the patch applied, I was able to create additional tasks and run them:
P.S. Without the PR, one error is that you can not run tasks which you have created when you are an administrator. This is also fixed by this PR, that’s why you can create tasks and run them as administrator.
Then the testing instructions seem to be misleading. It says: "Create a new task with an admin (not superuser) account." And that's what I did.
Hmm I see the testing instructions are not precise.
P.S. I've updated again testing instructions and added a test for trashed tasks.
I have tested this item ✅ successfully on eb813f6
I have tested this successfully.
(thanks for the updated testing instructions Richard!)
( Cool PR btw, thanks to all that made it possible ).
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.
I have tested this item ✅ successfully on eb813f6
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.
Thanks for testing.
| Labels |
Added:
RTC
|
||
Thank you!
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-01-18 22:24:11 |
| Closed_By | ⇒ | Hackwar |
How can it make sense for a user to be able to create a new task and setup lazy loading etc but not be able to run the task directly