PR-5.3-dev Pending

User tests: Successful: Unsuccessful:

avatar tecpromotion
tecpromotion
8 Aug 2025

Pull Request for Issue #45193 .

Summary of Changes

Changed the permission check from core.manage to core.admin for the Extensionupdate.php and the Joomlaupdate.php
This change restricts access to Super Users only, preventing regular administrators from accessing and viewing this feature.

Testing Instructions

Tested by verifying that the quickicon for Joomla Update is only visible to Super Users and not to regular administrators.
The quickiocn Override should be green (if there are no overrides to check).

Actual result BEFORE applying this Pull Request

Bildschirmfoto 2025-08-08 um 14 38 25

Expected result AFTER applying this Pull Request

Bildschirmfoto 2025-08-08 um 14 39 12

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar tecpromotion tecpromotion - open - 8 Aug 2025
avatar tecpromotion tecpromotion - change - 8 Aug 2025
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 8 Aug 2025
Category Front End Plugins
avatar tecpromotion
tecpromotion - comment - 8 Aug 2025

@ceford and @exlemor I would be delighted if you would test this PR.

avatar tecpromotion tecpromotion - change - 8 Aug 2025
The description was changed
avatar tecpromotion tecpromotion - edited - 8 Aug 2025
avatar exlemor
exlemor - comment - 8 Aug 2025

@ceford and @exlemor I would be delighted if you would test this PR.

Gladly... I'm on it.

avatar exlemor exlemor - test_item - 8 Aug 2025 - Tested successfully
avatar exlemor
exlemor - comment - 8 Aug 2025

I have tested this item ✅ successfully on b18c52a

I have tested this PR successfully and very happily. This will reduce my client calls by at least 1/2 (no joke) Thanks @tecpromotion!


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45872.

avatar brianteeman
brianteeman - comment - 8 Aug 2025

I am not convinced this is the correct approach as it hides that there are updates available. Even if you cannot do an update I believe the user should be informed an update is available

avatar tecpromotion tecpromotion - change - 15 Aug 2025
Labels Added: PR-5.3-dev
avatar tecpromotion
tecpromotion - comment - 15 Aug 2025

I am not convinced this is the correct approach as it hides that there are updates available. Even if you cannot do an update I believe the user should be informed an update is available

Thanks for your comment @brianteeman
Should it just be displayed (not clickable) or should a message appear when clicked telling the user to contact a super user?

avatar brianteeman
brianteeman - comment - 15 Aug 2025

I am not convinced this is the correct approach as it hides that there are updates available. Even if you cannot do an update I believe the user should be informed an update is available

Thanks for your comment @brianteeman Should it just be displayed (not clickable) or should a message appear when clicked telling the user to contact a super user?

Just displayed would be acceptable to me
Being asked to contact a super user would be preferred - I'm sure we have something similar to that somewhere

avatar tecpromotion
tecpromotion - comment - 15 Aug 2025

Just displayed would be acceptable to me Being asked to contact a super user would be preferred - I'm sure we have something similar to that somewhere

Okay, we use this check in different situations and in even more different ways.
Perhaps we can use this to our advantage.

// Access check. if (!$this->getCurrentUser()->authorise('core.admin')) { throw new NotAllowed(Text::_('JERROR_ALERTNOAUTHOR'), 403); }

avatar brianteeman
brianteeman - comment - 15 Aug 2025

But would that display that an update is available?

Please dont misunderstand me. The current situation is not good and needs to be fixed - I just believe that we should be able to inform admins that a new version is available even if they dont have the access to perform an update

avatar tecpromotion
tecpromotion - comment - 15 Aug 2025

But would that display that an update is available?

Please dont misunderstand me. The current situation is not good and needs to be fixed - I just believe that we should be able to inform admins that a new version is available even if they dont have the access to perform an update

What you would need to do in the onGetIcons function:

public function onGetIcons(QuickIconsEvent $event): void

  • In the early termination condition, only check the context.
  • Then determine separately whether the user has core.admin on com_installer.
  • Always build the icon, but adjust the link/class/title if the permission is missing.
avatar brianteeman
brianteeman - comment - 15 Aug 2025

sounds right to me

avatar ceford ceford - test_item - 17 Sep 2025 - Tested unsuccessfully
avatar ceford
ceford - comment - 17 Sep 2025

I have tested this item 🔴 unsuccessfully on 4b326d0

I applied the patch as Super User, went to the Home Dashboard and got this:

An error has occurred.
     0 Joomla\Plugin\Quickicon\Joomlaupdate\Extension\Joomlaupdate::__construct(): Argument #2 ($document) must be of type Joomla\CMS\Document\Document, array given, called in /Users/ceford/Sites/joomla-cms5/plugins/quickicon/joomlaupdate/services/provider.php on line 35 
Return to Dashboard
```<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/45872">issues.joomla.org/tracker/joomla-cms/45872</a>.</sub>
avatar tecpromotion tecpromotion - close - 29 Sep 2025
avatar tecpromotion tecpromotion - change - 29 Sep 2025
Status Pending Closed
Closed_Date 0000-00-00 00:00:00 2025-09-29 15:50:46
Closed_By tecpromotion

Add a Comment

Login with GitHub to post a comment