Uploaded image for project: 'Magnolia pages module'
  1. Magnolia pages module
  2. PAGES-444

User that is disalowed to create pages can move pages

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 6.2.11
    • 6.2.8
    • None
    • None

    Description

      Steps to reproduce

      1.  create roles allowing only superuser to create "Travel Home" pages:
      2.  Login with any "non-superuser" user
      3. Open Pages app
      4. (Notice that you cannot create a page of type "Travel Home", which is expected)
      5. Select an existing page of type "Travel Home" and select action "Move Page"
      6. Note that you are allowed to move the page literally everywhere

      Expected results

      Expectation is that "non-superuser" user is not allowed to move a page with the template that only superuser is allowed to create.

      Actual results

      "non-superuser" can move page of type "Travel Home".

      Additional Input

      Note that this is a regression from Magnolia 5.7.x as it worked there. This bug is reproducible on "Plain Magnolia" (e.g. https://demoauthor.magnolia-cms.com/ ).

      The issue seems to be that info.magnolia.module.site.templates.ConfiguredSiteTemplateAvailability#isAvailable is not called when doing "Move Page" while it was called in Magnolia 5.7.x.

      I set Prioriy to Major as this bug is security related.

      Workaround

      Legacy app works as expected, it can be used instead of the new app.

      Development notes

      Checklists

        Acceptance criteria

        Attachments

          Issue Links

            Activity

              People

                mdivilek Milan Divilek
                quatico Daniel Schneeberger
                Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  Checklists

                    Bug DoR
                    Task DoD