Bug #89240

Epic #90674: Backend UI not reflecting permissions

"Edit page properties" icon is displayed, even if page editing is not allowed for user

Added by Sybille Peters over 1 year ago. Updated 10 months ago.

Status:
Under Review
Priority:
Should have
Assignee:
-
Category:
Backend User Interface
Target version:
-
Start date:
2019-09-24
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
10
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Reproduce

  1. Create a user / group which does not have access to editing pages (pages not set in tables_modify)
  2. Switch to this user
  3. Select page
  4. Click on "Edit page properties"

Empty form appears. Also a reload animation is shown and does not end.

System

Used current TYPO3 master (10.1.0-dev).


Files

edit.png (7.9 KB) edit.png Sybille Peters, 2019-09-24 10:49

Related issues

Related to TYPO3 Core - Bug #90178: Page edit button in page module is not using BackendUserAuthentication::recordEditAccessInternals() for checking access permissionsNew2020-01-23

Actions
#1

Updated by Riccardo De Contardi over 1 year ago

Possibly related: #23598 , #83008, #88337

#2

Updated by Riccardo De Contardi over 1 year ago

  • Status changed from New to Needs Feedback

Hi, can you test if it has been solved with #88337 ?

If not, please I'd ask you to write in detail how to reproduce it; for example, where did you click to edit the page properties?

#3

Updated by Sybille Peters over 1 year ago

The patch 60937 referring to issue 88337 has been merged, so I assume I should test with master.

I can still reproduce the problem described in this issue with master: I still get the load animation if I click on pencil icon to edit a page the editor has no permission to (with "switch user").

IMHO, an editor with no write access to a page should not see the pencil icon at all.

#4

Updated by Riccardo De Contardi over 1 year ago

  • Status changed from Needs Feedback to New
#5

Updated by Gerrit Code Review about 1 year ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63245

#6

Updated by Georg Ringer about 1 year ago

  • Related to Bug #90178: Page edit button in page module is not using BackendUserAuthentication::recordEditAccessInternals() for checking access permissions added
#7

Updated by Riccardo De Contardi about 1 year ago

  • Parent task set to #90674
#8

Updated by Timo Webler 10 months ago

The same error occurs in the list module

Also available in: Atom PDF