Skip to content

[4.2] Fix check permission in mod_submenu#39486

Merged
roland-d merged 2 commits intojoomla:4.2-devfrom
heelc29:4.2/admin/modules/submenu
Jan 5, 2023
Merged

[4.2] Fix check permission in mod_submenu#39486
roland-d merged 2 commits intojoomla:4.2-devfrom
heelc29:4.2/admin/modules/submenu

Conversation

@heelc29
Copy link
Copy Markdown
Contributor

@heelc29 heelc29 commented Dec 24, 2022

Summary of Changes

The check of permissions for the menu items is different between mod_submenu (dashboards) and mod_menu (main menu).
administrator/modules/mod_submenu/src/Menu/Menu.php#L136 ff.
administrator/modules/mod_menu/src/Menu/CssMenu.php#L333 ff.

Testing Instructions

Enable workflows in article options:
image

Check the content dashboard with a user with these permissions on com_content:
image

Actual result BEFORE applying this Pull Request

Categories is only displayed in the main menu (also applies to com_contact, ...)
image

When you click on workflows
image

Expected result AFTER applying this Pull Request

Categories is displayed in the module of the dashboard
Module containing workflows is not displayed (because no access to core.manage.workflow of com_content)
image

Link to documentations

Please select:

  • No documentation changes for docs.joomla.org needed
  • No documentation changes for manual.joomla.org needed

@ceciogit
Copy link
Copy Markdown

ceciogit commented Dec 24, 2022

I have tested this item ✅ successfully on 22bb4fc

can replicate the issue, the pull request solved it.

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39486.

@carlitorweb
Copy link
Copy Markdown
Member

carlitorweb commented Dec 25, 2022 •
edited
Loading

I confirm the issue when you click on workflows and the PR fix it. But I have listed here Categories without apply the PR.

Captura

User permissions over com_content
Captura

@heelc29
Copy link
Copy Markdown
Contributor Author

heelc29 commented Dec 26, 2022

I confirm the issue when you click on workflows and the PR fix it. But I have listed here Categories without apply the PR.

@carlitorweb Ah, for my test I denied access core.manage globally and enabled it only for com_content. So without the patch it will try to check the permissions for com_categories that don't exist, thus falling back to the global permissions where core.manage is allowed.

Ok if you allow it globally you could deny it (core.manage) for com_content and then open the content dashboard. Here should the link to categories still visible but when you click on it you will get an 403?

image
image

@carlitorweb
Copy link
Copy Markdown
Member

carlitorweb commented Dec 30, 2022

Ok if you allow it globally you could deny it (core.manage) for com_content and then open the content dashboard. Here should the link to categories still visible but when you click on it you will get an 403?

No, the result is same, not show any relate resources to the content component
Captura

This are the permissions:
Captura

@heelc29
Copy link
Copy Markdown
Contributor Author

heelc29 commented Jan 2, 2023

No, the result is same, not show any relate resources to the content component

@carlitorweb Yes, in the main menu (mod_menu) is correct, but at dashboard (mod_submenu) is not correct.
image

There are tho test cases:

  1. I described in the test instruction (global: denied; content: allowed)
    • Link to Categories is missing at dashboard, although you have access and it is displayed in the (left) main menu
  2. You tested now (global: allowed; content: denied)
    • Link to Categories is displayed at dashboard, although you don't have access and it doesn't displayed in the (left) main menu --> 403 Error

image

@carlitorweb
Copy link
Copy Markdown
Member

carlitorweb commented Jan 2, 2023

Yes, in the main menu (mod_menu) is correct, but at dashboard (mod_submenu) is not correct.

This is correct, my fault. Now all is okay.

@carlitorweb
Copy link
Copy Markdown
Member

carlitorweb commented Jan 2, 2023

I have tested this item ✅ successfully on 22bb4fc

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39486.

@Quy
Copy link
Copy Markdown
Contributor

Quy commented Jan 2, 2023

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39486.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Jan 2, 2023
@roland-d
Copy link
Copy Markdown
Contributor

roland-d commented Jan 5, 2023

Thank you.

@roland-d roland-d added this to the Joomla! 4.2.7 milestone Jan 5, 2023
@roland-d roland-d merged commit 80e46d0 into joomla:4.2-dev Jan 5, 2023
@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Jan 5, 2023
@heelc29 heelc29 deleted the 4.2/admin/modules/submenu branch January 8, 2023 19:47
charvimehradu pushed a commit to charvimehradu/joomla-cms that referenced this pull request Jan 26, 2023
@heelc29 @charvimehradu
[4.2] Fix check permission for com_categories/com_workflow in mod_sub…
e2f4ebc 
…menu (joomla#39486)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

Joomla! 4.2.7

Development

Successfully merging this pull request may close these issues.

6 participants

@heelc29 @ceciogit @carlitorweb @Quy @roland-d @joomla-cms-bot