[#44060] - [5.4] Fix Toolbar access check when the content is filtered by multiple categories
- Pending
- Medium
- Build: 4.4-dev
- # 44060
- Diff
- Fedik:fix-access-check-44056
User tests: Successful: Unsuccessful:
Pull Request for Issue #44056.
Summary of Changes
Fix Toolbar access check when the content is filtered by multiple categories.
Testing Instructions
Code review, for now.
The ContentHelper::getActions() expecting an ID
Actual result BEFORE applying this Pull Request
ContentHelper::getActions() recieving an array of IDs
Expected result AFTER applying this Pull Request
ContentHelper::getActions() recieving single ID
Link to documentations
Please select:
- Documentation link for docs.joomla.org:
- No documentation changes for docs.joomla.org needed
- Pull Request link for manual.joomla.org:
- No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_contact com_content |
| Labels |
Added:
bug
PR-4.4-dev
|
||
| Title |
|
||||||
| Title |
|
||||||
| Labels |
Added:
PR-5.2-dev
|
||
This pull request has been automatically rebased to 5.3-dev.
| Title |
|
||||||
This pull request has been automatically rebased to 5.4-dev.
| Title |
|
||||||
| Labels |
Added:
PR-5.4-dev
Removed: PR-4.4-dev PR-5.2-dev |
||
Can you please supply some testing instructions which explain/show how to see the access check failure. Without that I fear this PR will sit untested for another year
This is something that should be obvious for maintainers.
1-2 review from mainteiners should be good enough to merge this pr.
Setting up the test case for general testing will take more time than it deserves.
I think the following testing instructions would work:
- Edit an article category, look at Permissions tab, select Administrator user group, set Create permission to Denied. That will prevent users from Administrator user group has permission to create articles for that category
- Login to administrator area of the site using an Administrator account (not super user account)
- Access to Articles Management screen. In categories filter dropdown, select the article above. The New button in the toolbar should not be displayed because user does not have permission to create article for that category. At the moment, the New button still being displayed. You can try to create a new article and assign it to that category, but it could not be saved.
- Apply patch, and after that, the New button in the toolbar won't be displayed as expected since the user does not have permission to create article for the category
@Fedik but the or condition will still be true and the button will be still shown.
Does it really make sense to check it here at all or am I missing something?
It would only be hidden if the user has no permissions at the core level and has only been explicitly granted permissions for specific categories. Is that what is intended? Than is works :)
This pull request has been automatically rebased to 5.2-dev.