Quick Edit (both module & from List Pages) bypasses category permissions when improper case used.
- Status
- Open
- Subject
- Quick Edit (both module & from List Pages) bypasses category permissions when improper case used.
- Version
- 8.x
- Category
- Conflict of two features (each works well independently)
- Feature
- Category
Permission - Resolution status
- New
- Submitted by
- nofixedabode
- Lastmod by
- nofixedabode
- Rating
- Description
Typing a page into Quick Edit, either in the Quick Edit module (I know it is depreciated but was testing this as well) or from the Create a Wiki Page tab on the List Wiki Pages seems to bypass category permissions and allows editing of pages which should be locked for the user. This happens if the page which is entered does not EXACTLY match the case of the existing page.
For example, in Global Permissions, Registered Users have Edit permissions; a category Alpha has Edit permissions assigned only to group Alpha, Registered Users have no edit permissions on this category. A page called Alpha exists in category Alpha. If a Registered User who is not part of group Alpha tries to create/edit page "Alpha", they receive the proper error about not having permissions to edit the page. Should that same user try to create/edit page "ALPHA", "alpha" or any variation which does not match exactly "Alpha", they will be allowed to edit the existing page "Alpha". This will also work if they enter the URL to edit the page directly with a different case (i.e. "tiki-editpage.php?page=Alpha" will prevent editing whereas "tiki-editpage.php?page=ALPHA" will allow editing).- Importance
- 5
- Priority
- 25
- Demonstrate Bug (Tiki 19+)
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Version: Create show2.tiki.org instanceAbout show2.tiki.orgTo help developers solve the bug, we kindly request that you demonstrate your bug on a show2.tiki.org instance. To start, simply select a version and click on "Create show2.tiki.org instance". Once the instance is ready (in a minute or two), as indicated in the status window below, you can then access that instance, login (the initial admin username/password is "admin") and configure the Tiki to demonstrate your bug. Priority will be given to bugs that have been demonstrated on show2.tiki.org.
- Ticket ID
- 4225
- Created
- Sunday 13 May, 2012 19:23:11 GMT-0000
by nofixedabode - LastModif
- Sunday 13 May, 2012 19:23:11 GMT-0000
Attachments
| filename | created | hits | comment | version | filetype | ||
|---|---|---|---|---|---|---|---|
| No attachments for this item | |||||||
;){kind=link}
;){kind=link}
- Wikiplugin img, the plugin is not able to display an image from anywhere on the internet
- Server check is raising false alarms about Tiki requirements
- File Galleries, Upload; have to try several times before successfully upload an image on dev.t.o
- Structures, Wiki pages; It should not be possible to create a page through structure with an "illegal" name
- Daily build zip file for Tiki26 is not available (404)
;){kind=link}
;){kind=link}