Add page interface still shows and loads when a user does not have permission

[NightJar]

4.3.x-dev @ 543307a

• Be an admin
• Site Config
• Access
• Who can create pages in the root of the site? Only these groups: Administrators
  
• Be a content editor (or other group with less permission)
  
• Load CMS pages admin
• Observe "Add page" button
  
• Click "Add page" button
• Select a page type to add, specifying the Top Level
  
• Click "Create"
• See no feedback other than easily missed toast popout simply stating "Forbidden"
  

Upon thinking about this further, the interface allows for creation of pages anywhere in the site tree, not just at the top level. So it does make sense that the button is always available, regardless of the current editing context (per the site tree interface widget).

However in the least it should be that Top level as an option is disabled if the user does not have permission to add a page to the top level. Ideally there'd be far more visible feedback as to why the create button has failed for the user too - perhaps with a little explanation for increased understanding.

PRs

• ENH Add disabled attribute to SelectionGroup silverstripe-framework#9741
• ENH Disable option to create top-level pages based on permissions #2604

[emteknetnz]

Enhanced by

• ENH Add disabled attribute to SelectionGroup silverstripe-framework#9741
• ENH Disable option to create top-level pages based on permissions #2604