Steps to reproduce the issue
Fresh install of Joomla 3.7.2
Create a user and assign the Publisher group.
Log into the front-end as the new user.
Edit an article, clicking the Image button to insert an image.
Navigate to a sub-folder (doesn't matter how many levels down the tree).
Click the Up button to return to the parent folder you were just in.
Expected result
The parent folder should be shown
Actual result
An error page is shown (403 error in Network tab)
System information (as much as possible)
Additional comments
This affects both front-end and back-end (as long as the user isn't a superuser).
It also affects other places which use the same file selector e.g. Images and Links tab.
Using the drop-down list next to the button which works fine, I've been able to see the difference between the requests. The working request has asset and author values set (asset=61&author=849) but the broken one does not have these values populated (asset=&author=):
403 from Up button:
GET http://example.com/folder/index.php?option=com_media&view=imagesList&tmpl=component&asset=&author=&folder=top/level-one
200 from drop-down:
GET http://example.com/folder/index.php?option=com_media&view=imagesList&tmpl=component&asset=61&author=849&folder=top/level-one
Steps to reproduce the issue
Fresh install of Joomla 3.7.2
Create a user and assign the Publisher group.
Log into the front-end as the new user.
Edit an article, clicking the Image button to insert an image.
Navigate to a sub-folder (doesn't matter how many levels down the tree).
Click the Up button to return to the parent folder you were just in.
Expected result
The parent folder should be shown
Actual result
An error page is shown (403 error in Network tab)
System information (as much as possible)
Additional comments
This affects both front-end and back-end (as long as the user isn't a superuser).
It also affects other places which use the same file selector e.g. Images and Links tab.
Using the drop-down list next to the button which works fine, I've been able to see the difference between the requests. The working request has asset and author values set (asset=61&author=849) but the broken one does not have these values populated (asset=&author=):
403 from Up button:
GET http://example.com/folder/index.php?option=com_media&view=imagesList&tmpl=component&asset=&author=&folder=top/level-one
200 from drop-down:
GET http://example.com/folder/index.php?option=com_media&view=imagesList&tmpl=component&asset=61&author=849&folder=top/level-one