You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This commit was created on GitHub.com and signed with GitHub’s verified signature.
🔒 Security
Moving a page now checks permissions on the server. Before, any Panel user could move any page to any parent by sending the dialog request directly, even without the Move entry in the page options.
To move a page, a user needs the plugin's owebstudio.move-pages.move permission and the changeSlug permission for that page (role permission and blueprint option). The home and error pages can no longer be moved.
A page can only be moved to one of the parents that the dialog offers.
A page can no longer be moved into one of its own children.
📦 Kirby versions
This plugin is now in maintenance mode and only gets security fixes. It supports Kirby 3.6 to 3.10.
Kirby 4 and newer can move pages out of the box. On Kirby 4 and 5 this plugin replaces the core Move dialog: the page options show two Move entries, the core entry fails on pages without the plugin's move option, and a role with pages.move: false can still move pages. Composer now refuses to install this version together with Kirby 4 or newer.
Upgrade notes
Kirby 3.6 to 3.10: replace the plugin folder or run composer update owebstudio/kirby-move-pages. Users without the changeSlug permission for a page can no longer move it.
Kirby 4 and 5: remove the plugin and use Kirby's own page move. Composer keeps version 2.3.2 there, which has the permission issue above. See Upgrading to Kirby 4.