Skip to content

[4.2] Fix permission overridecheck quickicon#39485

Merged
roland-d merged 2 commits intojoomla:4.2-devfrom
heelc29:4.2/plugins/quickicon/overridecheck
Dec 29, 2022
Merged

[4.2] Fix permission overridecheck quickicon#39485
roland-d merged 2 commits intojoomla:4.2-devfrom
heelc29:4.2/plugins/quickicon/overridecheck

Conversation

@heelc29
Copy link
Copy Markdown
Contributor

@heelc29 heelc29 commented Dec 24, 2022

Summary of Changes

The permission for show the quickicon and the link/ajax do not match (com_installer vs. com_templates)

joomla-cms/plugins/quickicon/overridecheck/overridecheck.php

Lines 68 to 77 in e9b9263

if ($context !== $this->params->get('context', 'update_quickicon') || !$this->app->getIdentity()->authorise('core.manage', 'com_installer')) {
return array();
}
$token = Session::getFormToken() . '=1';
$options = array(
'url' => Uri::base() . 'index.php?option=com_templates&view=templates',
'ajaxUrl' => Uri::base() . 'index.php?option=com_templates&view=templates&task=template.ajax&' . $token,
'pluginId' => $this->getOverridePluginId(),
);

Testing Instructions

Check the admin dashboard with a user with these permissions:
image

Actual result BEFORE applying this Pull Request

Ajax request get 403 status (forbidden)
image
image

When you click on the quickicon
image

Expected result AFTER applying this Pull Request

The quickicon is no longer displayed

Now if you swap permissions for com_installer/com_templates, the quickicon works correctly:
image
image

Link to documentations

Please select:

  • No documentation changes for docs.joomla.org needed
  • No documentation changes for manual.joomla.org needed

@carlitorweb
Copy link
Copy Markdown
Member

carlitorweb commented Dec 25, 2022

I have tested this item ✅ successfully on 9427139

Note: For get the right permission the test require, is enough with create a user under Registered group and add the "Access Administration Access" from the global configuration permissions. From there you can follow the test indication.

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39485.

@viocassel
Copy link
Copy Markdown
Contributor

viocassel commented Dec 28, 2022

I have tested this item ✅ successfully on 9427139

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39485.

@Quy
Copy link
Copy Markdown
Contributor

Quy commented Dec 28, 2022

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39485.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Dec 28, 2022
@roland-d roland-d merged commit 6ae3826 into joomla:4.2-dev Dec 29, 2022
@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Dec 29, 2022
@roland-d
Copy link
Copy Markdown
Contributor

roland-d commented Dec 29, 2022

Thank you

@roland-d roland-d added this to the Joomla! 4.2.7 milestone Dec 29, 2022
@heelc29 heelc29 deleted the 4.2/plugins/quickicon/overridecheck branch December 30, 2022 17:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

Joomla! 4.2.7

Development

Successfully merging this pull request may close these issues.

6 participants

@heelc29 @carlitorweb @viocassel @Quy @roland-d @joomla-cms-bot