Loading...
 
Skip to main content

Quick Edit (both module & from List Pages) bypasses category permissions when improper case used.

  • Tracker item actions
Trackers
Items
Status
Open
Subject
Quick Edit (both module & from List Pages) bypasses category permissions when improper case used.
Version
8.x
Category
  • Conflict of two features (each works well independently)
Feature
Category
Permission
Resolution status
New
Submitted by
nofixedabode
Lastmod by
nofixedabode
Rating
(0)
Description

Typing a page into Quick Edit, either in the Quick Edit module (I know it is depreciated but was testing this as well) or from the Create a Wiki Page tab on the List Wiki Pages seems to bypass category permissions and allows editing of pages which should be locked for the user. This happens if the page which is entered does not EXACTLY match the case of the existing page.
For example, in Global Permissions, Registered Users have Edit permissions; a category Alpha has Edit permissions assigned only to group Alpha, Registered Users have no edit permissions on this category. A page called Alpha exists in category Alpha. If a Registered User who is not part of group Alpha tries to create/edit page "Alpha", they receive the proper error about not having permissions to edit the page. Should that same user try to create/edit page "ALPHA", "alpha" or any variation which does not match exactly "Alpha", they will be allowed to edit the existing page "Alpha". This will also work if they enter the URL to edit the page directly with a different case (i.e. "tiki-editpage.php?page=Alpha" will prevent editing whereas "tiki-editpage.php?page=ALPHA" will allow editing).

Importance
5
Priority
25
Demonstrate Bug on Tiki 19+
Demonstrate Bug (older Tiki versions)
Ticket ID
4225
Created
Sunday 13 May, 2012 19:23:11 UTC
by nofixedabode
LastModif
Sunday 13 May, 2012 19:23:11 UTC


Show PHP error messages