Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EZP-32321: Added deleteTranslations target to fix 'content/remove' permission check #1703

Merged
merged 1 commit into from
Feb 5, 2021

Conversation

mikadamczyk
Copy link
Contributor

@mikadamczyk mikadamczyk commented Feb 2, 2021

Question Answer
Tickets https://issues.ibexa.co/browse/EZP-32321
Bug fix? yes
New feature? no
BC breaks? no
Tests pass? yes
Doc needed? yes
Related PR ezsystems/ezpublish-kernel#3084
License GPL-2.0

A bug occurs how long a policy content/remove has a language limitation. If 'initialLanguageCode' of content is the same as one of the allowed languages then the user can delete content. Because initial language code is set when content is edited in given language behavior is nondeterministic. To eliminate this bug additional "target" should be passed as an argument when the permission check I performed. After this change, if the user has content/remove policy with language limitations then he has to have access to all languages of content.

Documentation

After this change, if the user has content/remove policy with language limitations then he has to have access to all languages of content.
Below is an example of how a permission check could be achieved

$translations = $location->getContent()->getVersionInfo()->languageCodes;
$target = (new Target\Version())->deleteTranslations($translations);
$permissionResolver->canUser(
    'content', 'remove', $location->getContentInfo(), [$location, $target]
);

QA

  • moving content to trash
  • removing location
  • removing content from trash

Checklist:

  • Coding standards ($ composer fix-cs)
  • Ready for Code Review

@lserwatka lserwatka merged commit 6c713f8 into 1.5 Feb 5, 2021
@lserwatka lserwatka deleted the EZP-32321 branch February 5, 2021 08:00
@lserwatka
Copy link
Member

Could you merge it up?

@DominikaK DominikaK added the Doc needed The changes require some documentation label Mar 3, 2021
@DominikaK DominikaK removed the Doc needed The changes require some documentation label Mar 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
7 participants