Bug #89240

Epic #90674: Backend UI not reflecting permissions

"Edit page properties" icon is displayed, even if page editing is not allowed for user

Added by Sybille Peters 8 months ago. Updated 3 months ago.

Status:
Under Review
Priority:
Should have
Assignee:
-
Category:
Backend User Interface
Target version:
-
Start date:
2019-09-24
Due date:
% Done:

0%

TYPO3 Version:
10
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Reproduce

  1. Create a user / group which does not have access to editing pages (pages not set in tables_modify)
  2. Switch to this user
  3. Select page
  4. Click on "Edit page properties"

Empty form appears. Also a reload animation is shown and does not end.

System

Used current TYPO3 master (10.1.0-dev).

edit.png View (7.9 KB) Sybille Peters, 2019-09-24 10:49


Related issues

Related to TYPO3 Core - Bug #90178: Page edit button in page module is not using BackendUserAuthentication::recordEditAccessInternals() for checking access permissions New 2020-01-23

History

#1 Updated by Riccardo De Contardi 8 months ago

Possibly related: #23598 , #83008, #88337

#2 Updated by Riccardo De Contardi 7 months ago

  • Status changed from New to Needs Feedback

Hi, can you test if it has been solved with #88337 ?

If not, please I'd ask you to write in detail how to reproduce it; for example, where did you click to edit the page properties?

#3 Updated by Sybille Peters 7 months ago

The patch 60937 referring to issue 88337 has been merged, so I assume I should test with master.

I can still reproduce the problem described in this issue with master: I still get the load animation if I click on pencil icon to edit a page the editor has no permission to (with "switch user").

IMHO, an editor with no write access to a page should not see the pencil icon at all.

#4 Updated by Riccardo De Contardi 7 months ago

  • Status changed from Needs Feedback to New

#5 Updated by Gerrit Code Review 4 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63245

#6 Updated by Georg Ringer 4 months ago

  • Related to Bug #90178: Page edit button in page module is not using BackendUserAuthentication::recordEditAccessInternals() for checking access permissions added

#7 Updated by Riccardo De Contardi 3 months ago

  • Parent task set to #90674

Also available in: Atom PDF