Project

General

Profile

Actions

Bug #89240

closed

Epic #90674: Backend UI not reflecting permissions

"Edit page properties" icon is displayed, even if page editing is not allowed for user

Added by Sybille Peters over 4 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Backend User Interface
Target version:
-
Start date:
2019-09-24
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
10
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Reproduce

  1. Create a user / group which does not have access to editing pages (pages not set in tables_modify)
  2. Switch to this user
  3. Select page
  4. Click on "Edit page properties"

Empty form appears. Also a reload animation is shown and does not end.

System

Used current TYPO3 master (10.1.0-dev).


Files

edit.png (7.9 KB) edit.png Sybille Peters, 2019-09-24 10:49

Related issues 1 (1 open0 closed)

Related to TYPO3 Core - Bug #90178: Page edit button in page module is not using BackendUserAuthentication::recordEditAccessInternals() for checking access permissionsNew2020-01-23

Actions
Actions #1

Updated by Riccardo De Contardi over 4 years ago

Possibly related: #23598 , #83008, #88337

Actions #2

Updated by Riccardo De Contardi over 4 years ago

  • Status changed from New to Needs Feedback

Hi, can you test if it has been solved with #88337 ?

If not, please I'd ask you to write in detail how to reproduce it; for example, where did you click to edit the page properties?

Actions #3

Updated by Sybille Peters over 4 years ago

The patch 60937 referring to issue 88337 has been merged, so I assume I should test with master.

I can still reproduce the problem described in this issue with master: I still get the load animation if I click on pencil icon to edit a page the editor has no permission to (with "switch user").

IMHO, an editor with no write access to a page should not see the pencil icon at all.

Actions #4

Updated by Riccardo De Contardi over 4 years ago

  • Status changed from Needs Feedback to New
Actions #5

Updated by Gerrit Code Review over 4 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63245

Actions #6

Updated by Georg Ringer over 4 years ago

  • Related to Bug #90178: Page edit button in page module is not using BackendUserAuthentication::recordEditAccessInternals() for checking access permissions added
Actions #7

Updated by Riccardo De Contardi about 4 years ago

  • Parent task set to #90674
Actions #8

Updated by Timo Webler almost 4 years ago

The same error occurs in the list module

Actions #9

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63245

Actions #10

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63245

Actions #11

Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63245

Actions #12

Updated by Georg Ringer over 2 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #13

Updated by Benni Mack over 2 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF