[#6113] - Front-end module editing is blocked if you do not have component level permission
- Closed
- 17 Feb 2015
- Urgent
- Build: staging
- # 6113
- Diff
- mbabker:FEModuleACL
- Success The Travis CI build passed Details
User tests: Successful: Unsuccessful:
If a usergroup does not have component level frontend module editing permission but does have module level permission, a user should be able to edit the single module(s) they have permissions to. However, due to a bad ACL check, the user is given a "You are not authorized to access this resource" message when attempting to edit or save a module. The failure is caused by a check if either condition is false, whereas the check should be if both conditions are false. Corrected in PR.
Testing Instructions
Modified test instructions from what I wrote in #5397 as doing that is how I found the bug.
1) Create a new group and set the Group Parent as Public
2) In the Global Configuration give this group "Site Login" permission. Do not change any other values.
3) In the module(s) you want this group to be able to edit, give them "Frontend Editing" permission.
4) Ensure your group is in at least the "Registered" Viewing Access Level.
5) Create a user and assign them to this group.
6) Try to edit the module(s) the group has access to in the frontend, you should get the error.
7) Patch and try again, ensure your changes get saved.
joomla-cms-bot
- | Labels |
Added:
?
|
||
| Priority | Medium | ⇒ | Urgent |
| Category | ⇒ | ACL Front End Modules |
| Status | Pending | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-02-17 21:32:34 |
testing => blank page with not found text
in max reporting
Not Found
Fatal error: Call to undefined method stdClass::execute() in /home/com3elle/public_html/mygym.fr/components/com_config/config.php on line 28
I can't imagine how that could be related to this PR.
[Uploading patch.png . . .]()
if i apply this patch i have this error, if i revert no problem in front end editing
How do you apply the patch and on which code base?
And weher do you see that error? Which page are you trying to access?
1 i apply this patch
2 i try to edit my module in front
url to editing is
/index.php?option=com_config&controller=config.display.modules&id=149&return=aHR0cDovL2NvbTNlbGxlcy51cy9teWd5bS5mci9pbmRleC5waHA%2Fb3B0aW9uPWNvbV9jb250ZW50JnZpZXc9YXJ0aWNsZSZpZD0zNCZJdGVtaWQ9MjQ1I2V0ZQ%3D%3D
and i have a a blank page with not found text
3 i actived maximun reporting
Not Found
Fatal error: Call to undefined method stdClass::execute() in /home/com3elle/public_html/mygym.fr/components/com_config/config.php on line 28
Are you trying that patch on a Joomla 3.4.0 RC installation?
yes
Sounds like something went wrong there then with your installation. It's certainly not related to this patch.
..... i redo some test desactived specific editor... if i actived this patch this error appeair
if i desactived all was good for editing
Which editor was it?
i try ark editor (he create some error) but i change for jce but error was same
i can provide a acces to my dev site for any test
but the problem already exist lol
on your settings.
I suggest you do a reinstall and check again
ok i will try on fresh install
testing on fresh install (local mode wamp serveur)
joomla 3.4RC nothing other
redo all process for user and level access
without patch no error but message "your are not allow to edit..."
with patch
same error
Not Found
( ! ) Warning: Creating default object from empty value in C:\wamp\www\joomla34\components\com_config\config.php on line 25
Fatal error: Call to undefined method stdClass::execute() in C:\wamp\www\joomla34\components\com_config\config.php on line 28
if you want i can try to reboot my computer lol
The errors you post are coming from this file: https://github.com/joomla/joomla-cms/blob/staging/components/com_config/config.php
The lines in question:
$controllerHelper = new ConfigControllerHelper;
$controller = $controllerHelper->parseController($app);
$controller->prefix = 'Config';
// Perform the Request task
$controller->execute();
That means that in your case the creation of the controller class fails for some reason.
I have no clue why that is, but it certainly isn't related to this PR.
Please open a new issue for that.
ok i understand but note that didn't have any error message without this patch ...
now we can't test if this patch works
Merging based on review since it is obviously wrong.