Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#46805] - [5.4] check ACL when display link to user edit form

Updates Requested bug PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar heelc29
heelc29
31 Jan 2026

Pull Request for Issue from @chmst #pbf26

Summary of Changes

Checks the ACL (Access Control List) to decide whether to display a link or just the name.

Testing Instructions

  • login as an user who belongs to Manager group
  • view article or contact list and click on an user (which is not a super user) and click on it
image image
  • then login as superuser and change permission of user component for manager group; allow: Access Administration Interface and deny: Edit
image
  • login as an user who belongs to manager group again and click link again

Actual result BEFORE applying this Pull Request

1st try
image

2nd try
image

Expected result AFTER applying this Pull Request

name of user is only displayed - no link anymore
image
image

Link to documentations

Please select:

  • No documentation changes for docs.joomla.org needed
  • No documentation changes for manual.joomla.org needed
avatar heelc29 heelc29 - open - 31 Jan 2026
avatar heelc29 heelc29 - change - 31 Jan 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 31 Jan 2026
Category ⇒ Administration com_contact com_content
avatar exlemor exlemor - test_item - 31 Jan 2026 - Tested successfully
avatar exlemor
exlemor - comment - 31 Jan 2026

I have tested this item ✅ successfully on 67d7f2b

I have tested this successfully - thank you @heelc29!

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.

avatar ChristineWk ChristineWk - test_item - 1 Feb 2026 - Tested successfully
avatar ChristineWk
ChristineWk - comment - 1 Feb 2026

I have tested this item ✅ successfully on 67d7f2b

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.

avatar krishnaGandhi11 krishnaGandhi11 - test_item - 1 Feb 2026 - Tested successfully
avatar krishnaGandhi11
krishnaGandhi11 - comment - 1 Feb 2026

I have tested this item ✅ successfully on 67d7f2b

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.

avatar richard67 richard67 - change - 1 Feb 2026
Status Pending ⇒ Ready to Commit
Labels Added: RMDQ PR-5.4-dev
avatar richard67
richard67 - comment - 1 Feb 2026

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.

avatar richard67 richard67 - change - 1 Feb 2026
Labels Added: RTC bug
Removed: RMDQ
avatar muhme
muhme - comment - 3 Feb 2026

❌ Final test before merge with JBT

  • Installed Blog Sample Data, Created manager, editor, to-be-deleted users, Created 3 contacts with linked users, created articles as users manager, editor, to-be-deleted, deleted the to-be-deleted user entry
  • Seen 403 before in articles view and contacts and with user component permissions Edit Denied
  • Applied PR with Patch Tester
  • ✅ Articles/Contacts as Super User all Authors/Linked User entries are still linked names and the links are working
  • ✅ '[ None ]' is still displayed for deleted user entry
  • ✅ Articles/Contacts as manager other Authors/Linked User entries are only names and no more links
  • ❌ Articles/Contacts as manager: The user's own entry is no longer linked; previously, the user's own entry was linked and opening the user entry worked in Articles/Contacts
  • Changed user component permissions Edit Denied
    • ✅ Articles/Contacts as manager all Authors/Linked User entries are only names and no more linked
avatar muhme
muhme - comment - 3 Feb 2026

@heelc29 Thank you for your contribution. In final testing I found with user component permissions edit enables, the user's own entry is no longer linked. Before the PR, the user's own entry was linked and opening the user entry worked in Articles and Contacts. Could you please check?

avatar heelc29
heelc29 - comment - 4 Feb 2026

@heelc29 Thank you for your contribution. In final testing I found with user component permissions edit enables, the user's own entry is no longer linked. Before the PR, the user's own entry was linked and opening the user entry worked in Articles and Contacts. Could you please check?

Yes, you're right. There's an exception for this in the com_user dispatcher. I will update the check.

joomla-cms/administrator/components/com_users/src/Dispatcher/Dispatcher.php

Lines 40 to 48 in 3fad048

// Allow users to edit their own account
if (\in_array($task, $allowedTasks, true) || ($view === 'user' && $layout === 'edit')) {
$user = $this->app->getIdentity();
$id = $this->input->getInt('id');
if ((int) $user->id === $id) {
return;
}
}

avatar heelc29 heelc29 - change - 4 Feb 2026
Labels Added: Updates Requested
Removed: RTC
avatar heelc29 heelc29 - change - 4 Feb 2026
Labels Added: RTC
avatar richard67 richard67 - change - 5 Feb 2026
Status Ready to Commit ⇒ Pending
avatar richard67
richard67 - comment - 5 Feb 2026

Back to pending as changes have been requested.

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.

avatar richard67 richard67 - change - 5 Feb 2026
Labels Removed: RTC
avatar richard67 richard67 - change - 28 Jun 2026
Labels Removed: Updates Requested
avatar richard67
richard67 - comment - 28 Jun 2026

@exlemor @ChristineWk @krishnagandhicode Could you test again with the latest changes, including a check if the manager can edit their own account in the articles and contacts views, i.e. if the article was created by the current manager user or the contact is linked to that user, then the name of that user is a link to the user edit view?

avatar richard67
richard67 - comment - 28 Jun 2026

@exlemor @ChristineWk @krishnagandhicode Could you test again with the latest changes, including a check if the manager can edit their own account in the articles and contacts views, i.e. if the article was created by the current manager user or the contact is linked to that user, then the name of that user is a link to the user edit view?

Update 2026-06-29: Please wait, there are new change requests for this PR.

avatar richard67
richard67 - comment - 28 Jun 2026

@exlemor @ChristineWk @krishnagandhicode Could you test again with the latest changes, including a check if the manager can edit their own account in the articles and contacts views, i.e. if the article was created by the current manager user or the contact is linked to that user, then the name of that user is a link to the user edit view?

Update 2026-06-29: Please wait, there are new change requests for this PR. Done. Ready again for tests.

avatar heelc29 heelc29 - change - 29 Jun 2026
Labels Added: Updates Requested

Add a Comment

Login with GitHub to post a comment