TYPO3 Core

Bug persists in TYPO3 version 3.7.0RC1.

...which means it will not be fixed for 3.7 final because a change to something as security relevant as this needs more testing than just a few days.

Are there any proposals how to deal with that? Maybe there needs to be a possibility to select "Don't change" instead of an allowed pagetype?

There are some usability issues related to this:

If a user is not allowed to set the page type to "Advanced", does this imply he/she is also not allowed to edit any advanced page?

If yes, the "Edit page header" option has to be disabled for that page even if the permissions allow to modify the page settings for that user/group.

If no, he/she has two options to edit: He/she must change the page type to an allowed one.
In this case TYPO3 should immediately notify the user that he/she has to change the page type to save.

OR

- and this is what I would prefer - the page type select has to be modified so it recognizes that the inaccessible page type was set before and allow the user to save the page even with that page type. Also a correct warning should be issued near the select: Something like "If you change the page type you will not be able to select "Advanced" again because of insufficient permissions".

Bug persists in TYPO3 version 3.8.0beta1.

"- and this is what I would prefer - the page type select has to be modified so it recognizes that the inaccessible page type was set before and allow the user to save the page even with that page type. Also a correct warning should be issued near the select: Something like "If you change the page type you will not be able to select "Advanced" again because of insufficient permissions"."
I like that option most, too. Are there other comments on that?

Bug furthermore persists up to TYPO3 version 4.2.x.

Thanks for providing updates on this, Andreas!

Can you provide a patch?

Did this behavior change?
I tried it with 8LTS but I can't open the page editing, if I do not have rights to the page type.

I tried the following test with TYPO3 8.7.16

1) set up a usegroup that has no access to "external link" doktype
2) create a user and assign the usergroup
3) create a page of "external link" doktype
4) in access module, set the TYPO3 admin user as owner of the page and don't set the usergroup of the page

Results¶

- the pagetree does not show the page
- switching to list view, the page is still visible and the edit button is working. Clicking on it you get the error:

Sorry, you didn't have proper permissions to perform this change.

No page edit permission for user 2 on page 52 1437679336

The error is the same reported here: #75890

You get the same error if you set the usergroup of the page as the usergroup created at point 1) and give it edit privileges in Access module

Situation in TYPO3 9.5.1-dev is ok:

- created a usergroup "editor-group" without access to page-type 3 (Link to external Url)
- created a user "editor-user" based upon "editor-group"
- created a page of page-type 3
- in access-modul assigned the group of this page to "editor-group"
- switch to editor-user

Result:
- the page shows up in the page-tree
- trying to edit results in notice-message:
"Sorry, you didn't have proper permissions to perform this change.
No page edit permission for user 2 on page 5 1437679336"

this behaviour is ok.

Suggested improvements:
Remove edit buttons in this case, so that the user never encounters the notice-message

Same behaviour for 8.7.20-dev