db_new.php: positionTree() does not respect db mount of backend user
See screenshots attached.
If a user has a db mount on one sysfolder and the sysfolder got other pages / folders on the same treelevel around it, then these will be shown although they are not within the user's db mount.
I have to add: If the folders have different owner groups or no owner group at all they won't be shown. But often you have a setup where there is same base backend group for page rights and the specific pages for users will be added via db mount(s).
So, I think the method t3lib_positionMap->positionTree() should also respect the db mount properly when displaying the list of possible pages to create a new one after / in / before.
In some cases, this can be a real security issue if users are not supposed to see certain folders.
#1 Updated by Benni Mack over 7 years ago
- Category set to Backend User Interface
- Status changed from New to Accepted
wow. that seems reasonable and clearly and issue to be fixed. Interested in creating a patch for Gerrit for it?
All the best,
#3 Updated by Helmut Hummel over 7 years ago
Just checked, to be sure: Page permissions are checked correctly in the wizard. So if you don't want your users to see the pages, deny access to them.
Rethinking about it: If we change the wizard here, we should implement mountpoints to be a security feature in all places.
But maybe it is better to leave it as is and communicate better what mountpoints are and what they are not.
#4 Updated by Jochen Rieger over 7 years ago
Helmut, thanks for you check.
I, personally, would expect that mount points would be respected all over the system. And yet they are, for example in the link popup when chosing a page to link to.
AFAIK only in this wizard view appear pages that are outside the mount of an editor. If I mount an editor to a page node I want him to see only the selected node. Of cause, if there are restricted pages inside the mount I'd change the group access settings etc.
@ Benny: I'm somehow familiar with Gerrit but not with the rights / mount point thingy in backend code. If someone could provide another place where the mount point is respected I could manage it, I guess.