Bug #47144

Editor can always edit the default language of pages

Added by Philipp Gampe about 6 years ago. Updated 9 months ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Backend API
Target version:
-
Start date:
2013-04-11
Due date:
% Done:

100%

TYPO3 Version:
6.0
PHP Version:
5.4
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

An editor which has a language restriction to a non-default language can still edit page records in the default language via the page properties.
Editing content elements fails with "Language was not allowed".
The same message is shown if he edits the page properties, but only as debug message in the debug toolbar (bottom).


Related issues

Related to TYPO3 Core - Bug #47126: Disable users which are restricted to only non default languages to handle page records Closed 2013-04-11
Related to TYPO3 Core - Bug #75130: Editor with language restriction can edit page properties of default language New 2016-03-15

Associated revisions

Revision 0ad9a8c1 (diff)
Added by Henrik Ziegenhain over 3 years ago

[BUGFIX] Disable restricted users to edit page properties

This patch hides the edit page properties icon in page- and list-module
when a user is restricted to only non-default languages.

Resolves: #47144
Releases: master
Change-Id: Id87456416a7f92ffa3f6c45bb28f1a31226f8b5b
Reviewed-on: https://review.typo3.org/20454
Reviewed-by: Georg Ringer <>
Tested-by: Georg Ringer <>
Tested-by: Gianluigi Martino <>
Reviewed-by: Markus Klein <>
Tested-by: Markus Klein <>

History

#1 Updated by Frank Frewer about 6 years ago

Some more actions which should not be allowed to restricted users:
- via QuickEdit/[edit page properties]/'Move page'-button its possible to copy the page.
- via QuickEdit/[edit page properties]/'View record change history'-button its possible to change the page record.
- the user can manually call /typo3/sysext/cms/layout/db_layout.php?id=XX to edit the page record
- the same for history/undo: even if this entry in context menu is hidden the user could manually call the history modul via /typo3/show_rechis.php?element=pages:XX

#2 Updated by Henrik Ziegenhain about 6 years ago

I can confirm this for 6.0.x & 4.6.x

Patch from #47126 (thanks Frank) works, we only need a solution for this specific issue.

#3 Updated by Henrik Ziegenhain about 6 years ago

I did some research on this and found a simple solution for the main issue discovered by Philipp.
This solution does NOT solve the additional issues reported by Frank.

Page Module
Open typo3/sysext/backend/Classes/Controller/PageLayoutController.php and search for

// Edit page properties
if ($this->CALC_PERMS & 2) {

and replace with
// Edit page properties
if ($this->CALC_PERMS & 2 && $GLOBALS['BE_USER']->checkLanguageAccess(0)) {


List Module
Open typo3/sysext/recordlist/Classes/RecordList/DatabaseRecordList.php and search for

// If edit permissions are set (see class.t3lib_userauthgroup.php)
if ($localCalcPerms & 2 && !empty($this->id)) {

and replace with
// If edit permissions are set (see class.t3lib_userauthgroup.php)
if ($localCalcPerms & 2 && !empty($this->id) && $GLOBALS['BE_USER']->checkLanguageAccess(0)) {

My Question is how to put this to the review System? Could someone give me a hint/link to a documentation?

#4 Updated by Philipp Gampe about 6 years ago

Thanks for your findings.

Have a look here:
http://wiki.typo3.org/Contribution_Walkthrough_Tutorials

#5 Updated by Gerrit Code Review about 6 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20420

#6 Updated by Henrik Ziegenhain about 6 years ago

Hi Philipp,

thanks for your help. A few seconds ago I pushed my first patch to Gerrit :)
Hope everything is right.

#7 Updated by Gerrit Code Review about 6 years ago

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20453

#8 Updated by Gerrit Code Review about 6 years ago

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20454

#9 Updated by Gerrit Code Review about 6 years ago

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/21143

#10 Updated by Gerrit Code Review about 6 years ago

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/21144

#11 Updated by Henrik Ziegenhain about 6 years ago

I pushed a new patch to gerrit, which respects the new 6.2 and 4.5/4.7 for backporting.
I also changed two files mentioned by Dmitry.

Sorry for creating a new issue in Gerrit. How can I push a new patch set 2 for an existing one? (I am using TortoiseGit)

#12 Updated by Stefan Neufeind about 6 years ago

@Henrik: Just push to the same branch (for example master) and leave the Commit-Id unchanged. Gerrit will then know you're posting just a new revision and not a new patch.
Upon backports you'll then push to a different branch but still leave the Commit-Id unchanged. That will create a separate patch but will help keep track of the backport and it's siblings.

#13 Updated by Gerrit Code Review about 6 years ago

Patch set 2 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20454

#14 Updated by Henrik Ziegenhain about 6 years ago

Sorry for my messy pushes and thanks to Stefan for the hint.

Now I got it right and pushed patch set 2 to the originally created issue and abandoned the other one to keep the comments.

#15 Updated by Martin Eberle almost 5 years ago

any progress?

#16 Updated by Jens Jacobsen almost 5 years ago

Well just stumbled across this "bug" in TYPO3 6.2.4
Nasty! Some progress on this would be fine.

#17 Updated by Gerrit Code Review over 4 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/20454

#18 Updated by Gerrit Code Review over 4 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/20454

#19 Updated by Gerrit Code Review over 3 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/20454

#20 Updated by Gerrit Code Review over 3 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/20454

#21 Updated by Anonymous over 3 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#22 Updated by Benni Mack 9 months ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF