Fix ACL checks for pagebreak, articles com_content layouts (and their…

… editor XTD buttons) blocking legitimate editors (#17854) * removed unnecessary ACL checks (pagebreak, article XTD btns & content) * ACL check for articles modal view * fix typo * fixed edit permission chk and added ACL chks in btns * cleaned messages
joomla · Sep 25, 2017 · 2697670 · 2697670
1 parent bfad4c1
commit 2697670
Show file tree

Hide file tree

Showing 3 changed files with 63 additions and 39 deletions.
diff --git a/components/com_content/content.php b/components/com_content/content.php
@@ -16,18 +16,21 @@
 $input = JFactory::getApplication()->input;
 $user  = JFactory::getUser();
 
-if ($input->get('view') === 'article' && $input->get('layout') === 'pagebreak')
-{
-	if (!$user->authorise('core.create', 'com_content'))
-	{
-		JFactory::getApplication()->enqueueMessage(JText::_('JERROR_ALERTNOAUTHOR'), 'warning');
+$checkCreateEdit = ($input->get('view') === 'articles' && $input->get('layout') === 'modal')
+	|| ($input->get('view') === 'article' && $input->get('layout') === 'pagebreak');
 
-		return;
-	}
-}
-elseif ($input->get('view') === 'articles' && $input->get('layout') === 'modal')
+if ($checkCreateEdit)
 {
-	if (!$user->authorise('core.create', 'com_content'))
+	// Can create in any category (component permission) or at least in one category
+	$canCreateRecords = $user->authorise('core.create', 'com_content')
+	 || count($user->getAuthorisedCategories('com_content', 'core.create')) > 0;
+
+	// Instead of checking edit on all records, we can use **same** check as the form editing view
+	$values = (array) JFactory::getApplication()->getUserState('com_content.edit.article.id');
+	$isEditingRecords = count($values);
+
+	$hasAccess = $canCreateRecords || $isEditingRecords;
+	if (!$hasAccess)
 	{
 		JFactory::getApplication()->enqueueMessage(JText::_('JERROR_ALERTNOAUTHOR'), 'warning');
 

diff --git a/plugins/editors-xtd/article/article.php b/plugins/editors-xtd/article/article.php
@@ -35,25 +35,35 @@ class PlgButtonArticle extends JPlugin
 	 */
 	public function onDisplay($name)
 	{
-
+		$input = JFactory::getApplication()->input;
 		$user  = JFactory::getUser();
 
-		if ($user->authorise('core.create', 'com_content')
-			|| $user->authorise('core.edit', 'com_content')
-			|| $user->authorise('core.edit.own', 'com_content'))
+		// Can create in any category (component permission) or at least in one category
+		$canCreateRecords = $user->authorise('core.create', 'com_content')
+			|| count($user->getAuthorisedCategories('com_content', 'core.create')) > 0;
+
+		// Instead of checking edit on all records, we can use **same** check as the form editing view
+		$values = (array) JFactory::getApplication()->getUserState('com_content.edit.article.id');
+		$isEditingRecords = count($values);
+
+		// This ACL check is probably a double-check (form view already performed checks)
+		$hasAccess = $canCreateRecords || $isEditingRecords;
+		if (!$hasAccess)
 		{
-			$link = 'index.php?option=com_content&amp;view=articles&amp;layout=modal&amp;tmpl=component&amp;'
-				. JSession::getFormToken() . '=1&amp;editor=' . $name;
+			return;
+		}
+
+		$link = 'index.php?option=com_content&amp;view=articles&amp;layout=modal&amp;tmpl=component&amp;'
+			. JSession::getFormToken() . '=1&amp;editor=' . $name;
 
-			$button = new JObject;
-			$button->modal   = true;
-			$button->class   = 'btn';
-			$button->link    = $link;
-			$button->text    = JText::_('PLG_ARTICLE_BUTTON_ARTICLE');
-			$button->name    = 'file-add';
-			$button->options = "{handler: 'iframe', size: {x: 800, y: 500}}";
+		$button = new JObject;
+		$button->modal   = true;
+		$button->class   = 'btn';
+		$button->link    = $link;
+		$button->text    = JText::_('PLG_ARTICLE_BUTTON_ARTICLE');
+		$button->name    = 'file-add';
+		$button->options = "{handler: 'iframe', size: {x: 800, y: 500}}";
 
 		return $button;
-		}
 	}
 }
diff --git a/plugins/editors-xtd/pagebreak/pagebreak.php b/plugins/editors-xtd/pagebreak/pagebreak.php
@@ -35,24 +35,35 @@ class PlgButtonPagebreak extends JPlugin
 	 */
 	public function onDisplay($name)
 	{
+		$input = JFactory::getApplication()->input;
 		$user  = JFactory::getUser();
 
-		if ($user->authorise('core.create', 'com_content')
-			|| $user->authorise('core.edit', 'com_content')
-			|| $user->authorise('core.edit.own', 'com_content'))
+		// Can create in any category (component permission) or at least in one category
+		$canCreateRecords = $user->authorise('core.create', 'com_content')
+			|| count($user->getAuthorisedCategories('com_content', 'core.create')) > 0;
+
+		// Instead of checking edit on all records, we can use **same** check as the form editing view
+		$values = (array) JFactory::getApplication()->getUserState('com_content.edit.article.id');
+		$isEditingRecords = count($values);
+
+		// This ACL check is probably a double-check (form view already performed checks)
+		$hasAccess = $canCreateRecords || $isEditingRecords;
+		if (!$hasAccess)
 		{
-			JFactory::getDocument()->addScriptOptions('xtd-pagebreak', array('editor' => $name));
-			$link = 'index.php?option=com_content&amp;view=article&amp;layout=pagebreak&amp;tmpl=component&amp;e_name=' . $name;
-
-			$button          = new JObject;
-			$button->modal   = true;
-			$button->class   = 'btn';
-			$button->link    = $link;
-			$button->text    = JText::_('PLG_EDITORSXTD_PAGEBREAK_BUTTON_PAGEBREAK');
-			$button->name    = 'copy';
-			$button->options = "{handler: 'iframe', size: {x: 500, y: 300}}";
-
-			return $button;
+			return;
 		}
+
+		JFactory::getDocument()->addScriptOptions('xtd-pagebreak', array('editor' => $name));
+		$link = 'index.php?option=com_content&amp;view=article&amp;layout=pagebreak&amp;tmpl=component&amp;e_name=' . $name;
+
+		$button          = new JObject;
+		$button->modal   = true;
+		$button->class   = 'btn';
+		$button->link    = $link;
+		$button->text    = JText::_('PLG_EDITORSXTD_PAGEBREAK_BUTTON_PAGEBREAK');
+		$button->name    = 'copy';
+		$button->options = "{handler: 'iframe', size: {x: 500, y: 300}}";
+
+		return $button;
 	}
 }