Project

General

Profile

Actions

Bug #91900

open

Editor with language restriction to non-default language can't edit records of tables with inline fields configured with l10n_mode => exclude

Added by Tobias D over 3 years ago. Updated 9 months ago.

Status:
New
Priority:
Should have
Assignee:
-
Category:
Localization
Target version:
-
Start date:
2020-07-30
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
10
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

In one of our projects we have a table for locations. This table has a file relation field for images, which is configured with 'l10n_mode' => 'exclude'.

The default language is German. There is a folder in the page tree, which contains only russian locations (they aren't translations of a german record, but created directly in russian).

When an editor, who is restricted to only the russian language, tries to edit those records, he gets an error: "Sorry, you didn't have proper permissions to perform this change. ERROR: Language was not allowed.".

This likely happens, because the file relation in sys_file_reference is created with sys_language_uid = 0 when l10n_mode is set to exclude, resulting in an error, because the editor can't access the default language.

I tested this in the most recent versions of TYPO3 8, 9 and 10. They all behave identically.


Files

2022-10-20_10-51.png (20.5 KB) 2022-10-20_10-51.png Kevin Ditscheid, 2022-10-20 08:54
2022-10-20_10-53.png (32.5 KB) 2022-10-20_10-53.png Kevin Ditscheid, 2022-10-20 08:54
nonDefaultLanguageAccess.diff (1.5 KB) nonDefaultLanguageAccess.diff Kevin Ditscheid, 2022-10-21 06:45

Related issues 1 (1 open0 closed)

Related to TYPO3 Core - Bug #84119: Limiting a BE-User to default language results in inconsistent saves.New2018-03-02

Actions
Actions #1

Updated by Kevin Ditscheid over 3 years ago

  • Related to Bug #84119: Limiting a BE-User to default language results in inconsistent saves. added
Actions #2

Updated by Anonymous over 3 years ago

Facing a similar issue. Doe you already get "ERROR: Language was not allowed" on opening the record - or on save only?

Actions #3

Updated by Riccardo De Contardi over 2 years ago

  • Category set to Localization

Updated by Kevin Ditscheid over 1 year ago

This issue can still be reproduced in TYPO3 11.5.17.
A simple way to test this is using gridelements and create an element on a page, then translate the element and create a new element inside the default language element, but NOT translate that (see screenshot). Now switch to the language restricted user and click on the edit button.

Actions #5

Updated by Kevin Ditscheid over 1 year ago

I fixed this by editing backend/Classes/Form/FormDataProvider/DatabaseUserPermissionCheck.php and not throwing the AccessDeniedEditInternalsException, if the record has a language id === 0 and the inline parent having a language if !== 0.
This is a very dirty hack, that I am not willing to offer as a fix to the codebase, but I will append the diff here.
I am unsure on how to properly fix this, because imo this check should not even happen at this point.

Actions #6

Updated by Thomas Luzat about 1 year ago

Can confirm with TYPO3 11.5.24 and translated Gridelements, even though the page translation process created translated copies of the grid children (translated by copy, not reference).

The patch makes it work for me, but can't tell whether it limits access sufficiently as intended.

Actions #7

Updated by Steffen Krüchten 9 months ago

I can also confirm this bug in TYPO3 11.5.29 and translated "Container" content elements. Editors with access only to the spanish language and not the english default get an error with container elements that have a Media-Element in their configuration options (we use it to set a background-image of the container).

Without the image relation everything works fine but if the original has the relation set an editor without access to the default language gets an error message.

The Workaround above also works for me, not seeing any security problems as result of it for now.

Actions

Also available in: Atom PDF