Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Only users with advanced page permissions can change page permissions #7825

Open
1 of 2 tasks
jrief opened this issue Feb 28, 2024 · 1 comment
Open
1 of 2 tasks

Comments

@jrief
Copy link
Contributor

jrief commented Feb 28, 2024

Description

In CMS3, every user who had the permission page.has_change_permissions_permission(user) was allowed to change the permissions of a page, and optionally their descendants.

In CMS4, the inline view to change the page permissions moved into the advanced page settings view and now is only allowed to users with permission page.has_advanced_settings_permission(user).

This is incompatible behaviour which creates a lot of trouble for us.

Steps to reproduce

  • Login in as user with change page permissions on a certain page but w/o advanced page permissions.
  • In the CMS toolbar, start editing the current page.
  • In the dropdown menu, the "Advanced settings…" item is greyed out and hence he's unable to edit the page permissions.

Expected behaviour

As in CMS3.

Do you want to help fix this issue?

  • Yes, I want to help fix this issue and I will join #workgroup-pr-review on Slack to confirm with the community that a PR is welcome.
  • No, I only want to report the issue.

In my private repository, there is a patch which can be used to start a discussion on how to fix this.

jrief added a commit to jrief/django-cms that referenced this issue Feb 28, 2024
@jrief jrief added the 4.1 label Feb 28, 2024
@fsbraun
Copy link
Sponsor Member

fsbraun commented Feb 29, 2024

@Aiky30 Do you remember, why this was changed?

I can imagine the following scenarios:

  1. Move the permissions to the regular settings form and only show them if the user has the right to change them. (Bloats the regular settings and interferes with the page content separation from page.)
  2. Allow both users with page.has_advanced_settings_permission and with page.has_change_permissions_permission to open advanced settings and only show/change the relevant sections.
  3. Have a separate permissions form (just as in v3).

jrief added a commit to jrief/django-cms that referenced this issue Mar 1, 2024
@fsbraun fsbraun added this to the 4.2 milestone Apr 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Todo
Development

No branches or pull requests

2 participants