Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove uneeded ACL checks in template manager #7353

Merged
merged 1 commit into from Jul 10, 2015

Conversation

Bakual
Copy link
Contributor

@Bakual Bakual commented Jul 6, 2015

Issue

Currently, the template manager will refuse access if you don't have core.admin permissions in the template manager. This is due to some pointless check done in the extension entry point. If any of the checks core.manager, core.edit, core.create or core.admin fails, access is refused.
The original plan was probably to fail if all of those checks fail, but it was written wrong.

Solution

This PR brings the checks in line with other backends where we only check for core.manage. Additional checks are performed already in the various tasks to make sure appropriate ACL checks are performed when needed.

Testing

  • Create a user which has access to the template manager but is not able to change the permissions in there.
  • Currently access will be refused.
  • After applying this PR access will be granted. Depending on the permissions the user will be allowed to create/edit/whatever in the manager.

Note

Access to any file modification tasks (create overrides, edit files, ...) is restricted to global SuperUsers only. This is expected behavior as you can't really restrict a users permissions if that user has access to the files.

@brianteeman
Copy link
Contributor

Sorry for being thick but I dont see how to test

After applying this PR access will be granted. Depending on the permissions the user will be allowed to create/edit/whatever in the manager.

@Bakual
Copy link
Contributor Author

Bakual commented Jul 6, 2015

First of all, you should be able to create a user which is for example allowed to "create" and "edit", but not allowed to edit the options and permissions.
Currently that user will not be able to access the template manager at all. After this PR he will be able to access it.
From there, the "create" permission should allow him to duplicate (create) a template style and "edit" to edit the style.
The ACL rules only apply to template styles.

The template file editing is restricted hardcoded to global super user only due to security. Any other usergroup will only see the description and the preview button.

Hope that explains it better. If not, feel free to ask again 😄

@Kubik-Rubik Kubik-Rubik added this to the Joomla! 3.4.4 milestone Jul 9, 2015
@Kubik-Rubik
Copy link
Member

Good change, thank you @Bakual!


This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/7353.

@dgrammatiko
Copy link
Contributor

Works for me

@zero-24
Copy link
Contributor

zero-24 commented Jul 10, 2015

RTC 😄 Thanks


This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/7353.

@zero-24 zero-24 added the RTC This Pull Request is Ready To Commit label Jul 10, 2015
rdeutz added a commit that referenced this pull request Jul 10, 2015
Remove uneeded ACL checks in template manager
@rdeutz rdeutz merged commit 75afdb5 into joomla:staging Jul 10, 2015
@Bakual Bakual deleted the FixTemplatemanagerACL branch July 10, 2015 20:00
@zero-24 zero-24 removed the RTC This Pull Request is Ready To Commit label Oct 14, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants