I'm not sure whether to qualify this as a bug or a feature that just hasn't been implemented yet. Regardless it's a huge permission / article state integrity issue.

Concept

Joomla! ships with 3 main content contributor roles (groups) Author, Editor, Publisher. In most traditional senses the core concept behind these are:
1. Authors create

• Can only edit own
• Can't publish any (change state)
  1. Editors review
• Can edit all
• Can't publish any (change state)
  1. Publishers publish
• Can publish all (change state)

Issue

Joomla! only partially adheres to this concept.

Example

The author's ability to publish (change article state) should not be dependent on whether the article is already published.

Consider the scenario where an Author creates an article that is then set to "Published" by the Publisher. If an Author/Editor saves a change to that (published) article, those edits are not only saved as a new version but also as the published version.

In practice, when an Author makes changes to a published article, their changes should be saved as a new version, however the previous version should remain published until a Publisher sets that version's state to published.

Effectively publishing an article breaks the integrity of these permissions, and inherent work flow and relationship between Authors, Editors, Publishers.

Test

1. Create 3 Users
   • 1 Author
   • 1 Editor
   • 1 Publisher
2. Login as Author
   • Create Article 1
   • saved with "Unpublished" state
3. Login as Publisher
   • Publish Article 1
4. Login as Editor
   • Modify and Save Article 1
   • Click versions
   • This version is the new "Published" version, giving Editor publishing permission
5. Login as Author
   • Repeat all sub-steps from 4

Notes

Unfortunately, it's not as simple as intercepting the Save action, and preventing changes by Authors/Editors to be the new published version.

A pseudo workflow in com_content (or perhaps an entirely new view) is needed. This can be accomplished with the introduction of new states:

• Awaiting Review
• Approved
• Rejected

Workflow concept

Authors create new articles which are automatically saved with the state Awaiting Review.

Editors need a list of all new articles (Awaiting Review), and have the ability to set the state as either (Approved, Rejected, or back to Awaiting Review). Either deescalating back to the Author, escalating to Publishers, or leaving for review by another Editor.

Publishers need a list of all articles approved to be published (Approved) by Editors.