[5.x]: Users see index pages that they don't have permission to access

[MoritzLost]

What happened?

Description

I'm trying to set up multiple entry index pages on a project with lots of sections and custom sources. The problem is that all entry index pages appear for all users, even users with very limited permission.

The following screen recording shows what this looks like for a user with limited permissions:

custom-entry-index-pages.mov

• The first index page (Seiten) only shows All entries for the current user, but the user can't create any entry, because the only sections they have access to are in another index page.
• The second index page (Angebote) has the two sections the user has access to and works fine.
• The third and fourth index page are completely useless – the user doesn't have permission to any sections or sources in there. But they still appear, and the main part of the page shows a loading indicator that never goes away. The headings in the fourth index page are also there, but with nothing below them.

Expected behavior

Index pages don't seem to take permissions into account at all right now. This makes the feature basically unusable for projects where users have different sets of permissions.

Index pages where the user can't access anything should not appear in the navigation at all, similar to the way entry sources that the user can't access are hidden. In the screen recording above, the third and fourth index page should be hidden automatically.

There may also be a need to allow us to specifically assign index pages to groups, similar to the way it works for custom sources. In my example above, the first index page that only has All entries in it is superfluous and confusing to show for those authors, because all their content is already in a separate index page. So being able to hide this index page from them manually would be nice. Alternatively, this could be solved by adding the group permissions to the All entries source.

Craft CMS version

5.10.9

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[linear-code]

CMS-2293

[brandonkelly]

Thanks for pointing that out! Craft 5.10.12 is out with a fix.

[MoritzLost]

@i-just @brandonkelly Works great, thanks!

Any chance you could consider either adding the user groups setting to All entries (or to the index pages themselves)?
I don't want to disable this source completely, because it's useful for privileged editors. But for authors with very limited permissions, it results in two entry index pages, one of which is a bit redundant and doesn't allow them to create new entries:

(For now I solved that via a hook on Entry::EVENT_REGISTER_SOURCES, but would be nice to have a built-in solution for this.)

[brandonkelly]

@MoritzLost We’ll discuss that internally.