Loading...
 
Skip to main content

Global permission Can list trackers (tiki_p_list_trackers) is not applied

Status
Open
Subject
Global permission Can list trackers (tiki_p_list_trackers) is not applied
Version
23.x
25.x
Category
  • Bug
  • Consistency
Feature
Trackers
Resolution status
Confirmed
Submitted by
Bernard Sfez / Tiki Specialist
Keep informed
Jonny Bradley
Lastmod by
Bernard Sfez / Tiki Specialist
Rating
(0)
Description

We have a global permission tiki_p_list_trackers that should allow or deny groups to be able to see the list of trackers (tiki-list_trackers.php). This permission is only listed in the global permission (not object) so it is definitely all trackers.

Tested with a fresh Tiki25.x
See in the attached video:

It seems this permissions is simply ignored.

  1. Visiting the tracker list page as anonymous I can see the tracker list page with an empty table.
    What a un-happy UX/UI...When the is nothing to see, the user/visitor should clearly see nothing ? and eventually the reason he sees nothing. Not an empty table.
  2. If you change the object permission "tiki_p_view_trackers" for a tracker, it will be listed.


Doesn't make sense to me.
See my suggestions in the Solution field below.

before test in Tiki25

)

Tested at https://nextdev.tiki.org Last updated (GIT 23.x:19611): Thursday 09 September, 2021

Global permission Can list trackers (tiki_p_list_trackers) disable
Image

Anonymous can see in the trackers list different trackers
Image


Test 2 disabling ALL global permissions for trackers for anonymous (for all)
Image

Anonymous can now only see tracker5 listed
Image


Test 3 disabling Can view trackers (tiki_p_view_trackers) object permission for tracker5
Image

This (tracker) object permissions Can view trackers (tiki_p_view_trackers) is enable.


Test 4
Disabling this (tracker) object permissions Can view trackers (tiki_p_view_trackers)

Anonymous can't see the tracker5 listed, but still can see tiki-list_trackers.php and the menu item


Test 5
If I enable (one by one) for Anonymous:
Can create new tracker items (tiki_p_create_tracker_items)
Can change tracker items (tiki_p_modify_tracker_items)
Can remove tracker items (tiki_p_remove_tracker_items)
(I stopped here)

Anonymous can't see any trackers listed, but still can see tiki-list_trackers.php and the menu item



My understanding is that, as there is NO tiki_p_list_trackers permissions per tracker object is that this permission is a top layer that should be applied to display or hide tiki-list_trackers.php trackers=>list trackers

There are many cases you want users (groups) to access item(s) but not to see the trackers list without redoing the all display interface. "tiki_p_list_trackers" permission was an easy and cleaner (no empty list or un-useful menu item) way to be sure this doesn't happen. While there are other ways to achieve this, those are complicate and require power users knowledge.

I believe that in time something was omitted (broken) and it went under the radar.
May be because the permission label "Can view trackers (tiki_p_view_trackers)" is not clear enough vs "Can list trackers". It should have been "Can view tracker items" .

Solution
  1. When a group doesn't have "permission tiki_p_list" he simply shouldn't be able to see the table or page content, but a message You don't have permission to list the trackers.
  2. When user/visitor load tiki-list_trackers.php that lead to an empty table, he shouldn't see the table or page content but a message You don't have permission to list the trackers.
Importance
6
Easy to solve?
5
Priority
30
Demonstrate Bug on Tiki 19+
Demonstrate Bug (older Tiki versions)
Ticket ID
7824
Created
Monday 13 September, 2021 05:21:33 UTC
by Bernard Sfez / Tiki Specialist
LastModif
Tuesday 03 May, 2022 05:52:29 UTC


Show PHP error messages