Bug #90878
closedEditors with no page delete permissions can't delete content elements
100%
Description
- can edit any content
- can't delete pages
- The page will reload.
- The content is still there.
Cause of the problem appears to be this cleanup commit:
https://review.typo3.org/c/Packages/TYPO3.CMS/+/62763
This check:
if (!$noRecordCheck && !$this->doesRecordExist($table, $uid,'delete')) {
changed to:
if (!$noRecordCheck && !$this->doesRecordExist($table, $uid, Permission::PAGE_DELETE)) {
The cleanup commit message states, that 'delete' only stands for "delete page". But if you look at the content of the function DataHandler::recordInfoWithPermissionCheck() you can see, that the $perm 'delete' will automatically be converted to 'edit' or 'editcontent', if the tables is not 'pages'. (Yeah, this permissis stuff in here is pretty convoluted and dumb, but we are talking about DataHandler here)
So the changes made in the mentioned line above now always check for the page delete permissions and fail to fall back to the content element edit permissions, as it was previously done.
Updated by Gerrit Code Review over 4 years ago
- Status changed from New to Under Review
Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63999
Updated by Christian Eßl over 4 years ago
- Related to Task #90019: Clean up Page Permission handling in DataHandler added
Updated by Gerrit Code Review over 4 years ago
Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63999
Updated by Gerrit Code Review over 4 years ago
Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63999
Updated by Christian Eßl over 4 years ago
- Priority changed from Should have to Must have
- Target version set to 10 LTS
Updated by Christian Eßl over 4 years ago
- Related to Bug #91060: Non-admin Backend users cannot delete records added
Updated by Christian Eßl over 4 years ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset d517e43ff699cc25d1c6fb1ae0d71a70d92997a9.