?

User tests: Successful: Unsuccessful:

avatar sanderpotjer
sanderpotjer
12 Jul 2014

Currently several ACL checks are performed against the "core.admin" (Configure) action for the Redirect Manager, which isn't correct. This patch fixes the wrong checks.

JoomlaCode: http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=33914
Pull Request for Joomla 3: #3888

Test instructions:

  • Create a new user group "Test" with Public as Parent Group
  • Go to the Global Configuration, tab permissions, and allow "Admin Login" for this group
  • Go to Users -> Access Levels, open level "Special" and assign the group "Test" to the level
  • Go to the Redirect manager, click on the Options button, open the permissions tab and allow these actions for the "Test" user group:
    • "Access Administration Interface"
    • "Edit"
    • "Edit State"
    • "Delete"
  • Create test user, assign to Test group only
  • Login with test user
  • Confirm that you can't:
    • change the state of a redirect item
    • empty the items that are in the trash
    • select one or more item(s), and update the Destination URL by using the "Destination URL" feature at the bottom of the page
  • apply patch
  • Confirm that your test user now can:
    • change the state of a redirect item (Edit State)
    • empty the items that are in the trash (Delete)
    • select one or more item(s), and update the Destination URL by using the "Destination URL" feature at the bottom of the page (Edit)
  • Change the permissions for the mentioned actions, and confirm you can or con't perform above actions depending the ACL setting.

Thank you for testing!

avatar sanderpotjer sanderpotjer - open - 12 Jul 2014
avatar dbhurley
dbhurley - comment - 12 Jul 2014

+1 Looks good to me. Works as expected.

avatar Bakual Bakual - reference | 8fa7584 - 12 Jul 14
avatar Bakual
Bakual - comment - 12 Jul 2014

Merged into 2.5.x. Thanks!

avatar Bakual Bakual - change - 12 Jul 2014
Status New Closed
Closed_Date 0000-00-00 00:00:00 2014-07-12 20:44:01
avatar Bakual Bakual - close - 12 Jul 2014
avatar Bakual Bakual - close - 12 Jul 2014
avatar sanderpotjer sanderpotjer - head_ref_deleted - 12 Jul 2014

Add a Comment

Login with GitHub to post a comment