Description
A user with VIEW/EDIT (but not ADMINISTRATE) rights on a Form Builder category renamed the category. Rock returned an "unauthorized" error on save, but the rename was applied anyway and the category's security permissions were wiped, making the category invisible to all users, including admins, in the UI. Attempting to open the Security dialog on the affected category crashes the application pool (unhandled exception, w3wp.exe terminates and IIS restarts it).
Actual Behavior
Partial/unauthorized write occurs: the category name change is saved even though the authorization check fails and blocks the security-related portion of the save.
The category's security (Auth) records are cleared as a side effect, leaving the category inaccessible to everyone through normal navigation (only reachable via direct URL).
Opening the Security dialog on a category with no Auth records throws an unhandled exception that isn't caught anywhere in the request pipeline, crashing the w3wp.exe process (Exception code 0xc00000fd)
Expected Behavior
If a user lacks ADMINISTRATE rights, the rename should be rejected entirely and no changes (name or security)
Viewing/editing security on any category should never crash the application, regardless of the category's current security state.
Steps to Reproduce
As a user with VIEW and EDIT (not ADMINISTRATE) rights on a Form Builder category, open the form and attempt to edit/rename the category the form belongs to.
Click Save.
Observe the error: "You are not authorized to edit this category."
Despite the error, the category name change is persisted.
Check the category's security: all previously assigned security permissions on the category are gone.
As an Administrator, navigate to the category directly via URL — it loads without issue.
From that page, click the padlock/security icon to view or set security on the category.
The application crashes (w3wp.exe faults, IIS recycles the app pool). See event log detail below.
Issue Confirmation
Rock Version
19.3
Client Culture Setting
en-us
Description
A user with VIEW/EDIT (but not ADMINISTRATE) rights on a Form Builder category renamed the category. Rock returned an "unauthorized" error on save, but the rename was applied anyway and the category's security permissions were wiped, making the category invisible to all users, including admins, in the UI. Attempting to open the Security dialog on the affected category crashes the application pool (unhandled exception, w3wp.exe terminates and IIS restarts it).
Actual Behavior
Partial/unauthorized write occurs: the category name change is saved even though the authorization check fails and blocks the security-related portion of the save.
The category's security (Auth) records are cleared as a side effect, leaving the category inaccessible to everyone through normal navigation (only reachable via direct URL).
Opening the Security dialog on a category with no Auth records throws an unhandled exception that isn't caught anywhere in the request pipeline, crashing the w3wp.exe process (Exception code 0xc00000fd)
Expected Behavior
If a user lacks ADMINISTRATE rights, the rename should be rejected entirely and no changes (name or security)
Viewing/editing security on any category should never crash the application, regardless of the category's current security state.
Steps to Reproduce
As a user with VIEW and EDIT (not ADMINISTRATE) rights on a Form Builder category, open the form and attempt to edit/rename the category the form belongs to.
Click Save.
Observe the error: "You are not authorized to edit this category."
Despite the error, the category name change is persisted.
Check the category's security: all previously assigned security permissions on the category are gone.
As an Administrator, navigate to the category directly via URL — it loads without issue.
From that page, click the padlock/security icon to view or set security on the category.
The application crashes (w3wp.exe faults, IIS recycles the app pool). See event log detail below.
Issue Confirmation
Rock Version
19.3
Client Culture Setting
en-us