"Add New" flyout/dropdown menu wrongly includes template that user lacks "create" permission for

[Toutouwai]

Short description of the issue

I have a template "location" that is allowed under parents with the "region" template.

The "editor" role does not have the "create" permission for the location template.

But users with this role see "Location" in the dropdown and flyout menus for "Add New"

If they click either of these menu items there are no allowed parent pages.

Expected behavior

Users without the create permission for a template shouldn't see the option to add a new page with that template in "Add New".

Setup/Environment

• ProcessWire version: 3.0.239

[ryancramerdesign]

@Toutouwai I can't seem to duplicate that issue here. You might double check that the session is fresh and doesn't have cached menus, i.e. logout and log back in again.

I'd also go to Access > Roles > editor just to confirm everything looks correct there and then Save.

Next, check if there are any access control hooks present on this particular installation, whether your own, or from a module.

Also check if there are any "Additional edit permissions and overrides" defined for your location template on the Access tab, and then hit Save. Login with the editor user again to see if anything has changed.

[Toutouwai]

Everything is normal with the editor role and there are no hooks or modules besides Tracy Debugger.

The problem seems to be in Templates::getParentPage(). My "location" template allows multiple parents. This seems to have the effect that no access check takes place in the logic of that method.

Here are some dumps made at line 782 in case it helps:

The method then returns a null page because of the line

if($foundParentQty > 1) return $pages->newNullPage();

[ryancramerdesign]

@Toutouwai Thanks for the additional info. I was eventually able to reproduce it after trying a few different scenarios. I've refactored that Template::getParentPage() method which will hopefully fix it. Can you confirm? Also note that the "add new" dropdowns use a session cache, so you logged in when applying this update, you'd need to logout and login again in order to see the change.

[Toutouwai]

Thanks, it's working now.

[elabx]

Hi!

It just occurred to me that this recent fix made the login of one site I manage noticeably slower. A template with around 12k pages, had another template configured as a possible children , and was enabled by default in the "Add new" menu (parent being the template with 12k pages).

Tracked this selector with ProfilerPro and realized it happens in the refactored getParentPage() method.

"templates_id={$template_id}, include=unpublished, sort=status"

$template_id being the template with 12k pages. This selector takes around 50 seconds in my local install

I do wonder if this rather speaks of a potential issue with db indexes in my specific scenario?

Thanks!