[5.x]: Authors can't add additional authors to their own entries under certain conditions

[EFWall]

What happened?

Description

Authors who have permission to view, create, save and delete their own entries in a section that allows for more than one author per entry, but who don't have the permission to view other users' entries, can no longer add additional authors or edit the existing authors on entries where they are an author.

This is a change from previous behavior. When multiple authors per entry was first released, the behavior described above was allowed. I believe it may have changed as a result of this update -> #18298

But this change in behavior doesn't seem to be within the intent of that update, which was intended to prevent people who are not authors on entries but who had the ability to view and save other users' entries from hijacking these entries and making changes to them. In this case, it is preventing users who are authors from editing their own entries in a specific way.

The result is that there no longer appears to be a way to allow more than one user to view or edit a specific entry without allowing those users who need this ability to view ALL other entries in the section.

Steps to reproduce

1. While impersonating a user who has permission to view, create, save and delete their own entries in a section that allows for more than one author per entry, but who doesn't have the permission to view other users' entries, create a new entry.
2. Attempt to add an additional author to the entry.

Expected behavior

1. Should allow this user to add additional authors to entries on which they are an author.
2. Should allow this user to remove additional authors from entries on which they are an author.

Actual behavior

1. Doesn't allow the user who is an author on the entry to add additional authors or delete existing authors.

Craft CMS version

5.9.18

PHP version

8.3.14

[linear]

CMS-1956

[i-just]

Hi, thanks for reporting!

Up until v5.9.0, users with permissions to create, update, save and delete entries in a section that allows multiple authors were not shown the author input on the entry edit page, and so couldn’t add any other authors. As of v5.9.0, those users see a readonly author input and also can’t add any other authors, so in terms of functionality nothing really changed here.

That said, if you have permission to saveEntries and you’re the author (or one of the authors) of an entry, you should be able to edit authorship.

I raised a PR for this.