3.6.3: Allow author to use xtd-editors #12353

infograf768 · 2016-10-08T15:47:30Z

Pull Request for Issue # #10653 (comment) and #12338

Moving the access to the xtd-editors buttons to the plugins themselves.
Allow authors to use xtd-articles and pagebreak.

Main reason: displaying the list of articles to an author or to an Editor does not change the kind of articles displayed in the lists, therefore it is useless to prevent authors from using these lists.
Concerning issues with modals in frontend, this now makes sure all xtd-editors modals are only used by logged in users (Image was already taken care of).

To test:
Make sure you have a menu item to Submit Article in frontend, log as a Author, then submit article and use the buttons Articles, Pagebreak, Module.

dgrammatiko · 2016-10-08T15:55:59Z

@infograf768 I still believe that the javascript should be on the layout file and not in the plugin. But that's another issue...
I will test later on

infograf768 · 2016-10-08T15:58:12Z

@DGT41
Concerning the js, we can, if desired, move it in later J! releases. For now, we just need to make sure someone is logged in and access to these xtd-editors is OK for authors.

dgrammatiko · 2016-10-08T16:00:45Z

@infograf768 I know, it just bothers me that although someone could (potentially) change the mark up on these views, they have to rewrite the plugins for some lines of js...
But this problem you are solving here, is way more important!

AlexRed · 2016-10-09T08:34:05Z

Now is ok, but is different from the admin panel procedure.
After set the Pagebreak by Author in frontend now show a iframe in the modal windows. Inside the iframe there is the website homepage.
Also for the module button.

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12353.}

infograf768 · 2016-10-09T08:40:27Z

@AlexRed
Not here on 3.6.3-dev

AlexRed · 2016-10-09T08:56:05Z

Please see the video test: http://www.alexred.com/joomla/page-break01.gif

infograf768 · 2016-10-09T09:06:41Z

@AlexRed
Maybe you should use staging + patch. Here is my video

AlexRed · 2016-10-09T09:08:38Z

I use today Nightly + patch

brianteeman · 2016-10-09T09:30:01Z

I get exactly the same behaviour as @AlexRed with current staging

brianteeman · 2016-10-09T09:30:24Z

I have tested this item 🔴 unsuccessfully on ffdfe68

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12353.}

dgrammatiko · 2016-10-09T09:36:54Z

@AlexRed can you try the following:

insert

$this->eName    = JFactory::getApplication()->input->get('e_name', '', 'cmd');

at line 11 on administrator/components/com_content/views/article/tmpl/pagebreak.php

and report if that fixes the problem?

brianteeman · 2016-10-09T09:40:35Z

@DGT41 no it doesnt fix it and the issue is in more than page break - it can also be seen with other exitor-xtd such as modules

infograf768 · 2016-10-09T14:54:58Z

I confirm the issue on a clean installation WHEN using using TinyMCE.

Please folks, test using Codemirror instead of tinyMCE.
@AlexRed @brianteeman

@DGT41
Looks like we do need a similar patch as the one you did for 3.7:
#12324

brianteeman · 2016-10-09T14:56:11Z

What would be the point of that. It needs to work with all the editors

infograf768 · 2016-10-09T14:58:32Z

The point is that we have an issue with TinyMCE, NOT with the xtd-editors buttons

infograf768 · 2016-10-09T15:04:42Z

I do confirm: clean install, NO patch, SuperAdmin logged in frontend, using the pagebreak or modules button: we get the same issue you folks noted when using TinyMCE

brianteeman · 2016-10-09T15:21:22Z

Thanks for wasting our time. When you have fixed this PR please let us know. No point at all testing if it works with a different editor

infograf768 · 2016-10-09T15:24:08Z

Please test what I said:
use staging and log in as admin, try to use the xtd-editors buttons WITHOUT this patch and logged as superadmin in frontend.
This PR is just showing another release blocker issue that was happening BEFORE it.
It has been solved in 3.7 with #12324

You should rather thank me for finding this out a few days before release...

AlexRed · 2016-10-09T15:31:10Z

yes, I can confirm same problem without this patch as superadmin in frontend.

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12353.}

infograf768 · 2016-10-09T17:01:58Z

Folks, first patch with #12372 (Thanks @DGT41 )
then you can test again with TinyMCE.

dgrammatiko · 2016-10-09T17:14:57Z

I have tested this item ✅ successfully on ffdfe68

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12353.}

AlexRed · 2016-10-09T17:19:29Z

I have tested this item ✅ successfully on ffdfe68

ok with #12372

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12353.}

dgrammatiko · 2016-10-09T17:44:40Z

RTC

This should be merged together with #12372

wilsonge · 2016-10-09T17:57:26Z

components/com_content/content.php

-		return;
-	}
-}
-elseif ($input->get('view') === 'articles' && $input->get('layout') === 'modal')


I think we still need the modal check here?

i do not think so. we already did not need to check for image as it is done in the plugin.
now that we do check in the plugins for all xtds, these are imho useless.
if you insist on keeping some checks here, we would have to change this code and add all xtds here with the correct permissions, as is now done in the plugins themselves.

@wilsonge
After thought: let's test again to see if we avoid # 33. Will try right now. If needed, I will add all the xtds necessary checks .

Tested, looked fine.

brianteeman · 2016-10-11T11:03:34Z

Remove the RTC tag

ggppdk · 2016-10-11T12:01:57Z

The ACL check on the component for displaying e.g. pagebreak is not proper (and for the XTD buttons)

https://github.com/joomla/joomla-cms/pull/12353/files#diff-58d7af9fe491285c0bec790cf59c6cc3R38

You can have create / edit / edit.own on a category and not have it at the component level,

thus this check is broken for all sites that do not give to their usergroups, these permissions to the component, but instead give them to specific categories (or even specific articles), i had describe this here:

#10653 (comment)

if it is decided not to drop the ACL checks for the pagebreak, then one needs to pass and check a specific "current" record (article) asset

infograf768 · 2016-10-11T12:11:18Z

@ggppdk
Indeed, this patch was not aimed at solving fully the ACLs. Just to let author access these xtds with existing ACL (adding create and editown.

As a RC-3 has now been released, I suggest you propose a PR to implement it fully.

Hackwar · 2016-10-15T21:59:43Z

Please revert this PR. This effectively removes any access checks against the articles view in the backend. Everybody can now access the articles view, even with a guest user. You added checks to prevent a link from being displayed, but not opening the actual resource.

Simply open ?option=com_content&view=articles&layout=modal&tmpl=component&{formtoken}=1 on your site and you get a list of all articles that have public viewlevel.

Hackwar · 2016-10-15T22:09:27Z

This not only gives you a complete list of the public articles (some of which maybe should not be found yet), it also gives you a complete list of your sites categories, viewlevels, authors and more. A nice truckload of information to further construct attacks against your site.

infograf768 · 2016-10-16T06:02:56Z

@hannes
using the link you provide above as a guest, registered or author, I just get un frontend:
The most recent request was denied because it contained an invalid security token. Please refresh the page and try again.

Now, an author can indeed use the xtd when creating an article, which was not possible before.

When using the same link when not logged in backend just displays the login page

infograf768 · 2016-10-16T06:06:08Z

Now, as I said, we can re-add the checks in
ROOT/components/com_content/content.php, but using instead of only core.edit, also core.create and core.editown

Hackwar · 2016-10-16T07:17:24Z

Sorry, github swallowed parts of my link. You need to replace {formtoken} with the token. You can get that token from for example the login or contact-form view. This is a serious security issue!

infograf768 · 2016-10-16T07:32:33Z

@Hackwar
I can re-add the checks in content.php but also including create an edit.own
Would that be OK for you? I mean: is it OK for you to let authors use these xtds (will be the same isssue for the 3.7 branch and its new xtds)

infograf768 · 2016-10-16T07:53:14Z

Taking into account your comment here:
#12321 (comment)

I will now make a PR towards staging

Hackwar · 2016-10-16T07:56:10Z

Re-adding that check is a good first step. From my perspective, we need to further check this and consider what we display to editors, etc. Should someone with frontend editing capabilities see all categories, viewlevels and articles in the modal? I'd say that we have to restrict all of this to only those elements that the user would have access to.

infograf768 · 2016-10-16T15:39:39Z

As we can't right now do all necessary checks, this #12435 will let authors access to the xtds while preventing guest or registered users.
It just changes the limitation from editor to author.

3.6.3: Allow author to use xtd-editors

ffdfe68

joomla-cms-bot added the PR-staging label Oct 8, 2016

This was referenced Oct 8, 2016

core.edit.own permission doesn't allow to insert article link with a XTD "Article" button #10653

Closed

"page break" button in frontend can't be used by an "Author" #12338

Closed

zero-24 added this to the Joomla 3.6.3 milestone Oct 8, 2016

zero-24 added the Release Blocker label Oct 8, 2016

joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Oct 9, 2016

wilsonge reviewed Oct 9, 2016

View reviewed changes

rdeutz merged commit 8acabc8 into joomla:staging Oct 11, 2016

rdeutz removed the Release Blocker label Oct 11, 2016

joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Oct 11, 2016

infograf768 mentioned this pull request Oct 15, 2016

Fix front end XTD menus and contacts buttons #12321

Merged

infograf768 mentioned this pull request Oct 16, 2016

3.6.3: IMPORTANT! Preventing undesired access to guests/registered #12435

Merged

infograf768 mentioned this pull request Nov 4, 2016

New xtd-editors menu and contact display buttons only if correct permissions #12746

Closed

Uh oh!

3.6.3: Allow author to use xtd-editors #12353

3.6.3: Allow author to use xtd-editors #12353

Uh oh!

Conversation

infograf768 commented Oct 8, 2016 • edited by joomla-cms-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dgrammatiko commented Oct 8, 2016

Uh oh!

infograf768 commented Oct 8, 2016

Uh oh!

dgrammatiko commented Oct 8, 2016

Uh oh!

AlexRed commented Oct 9, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

infograf768 commented Oct 9, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlexRed commented Oct 9, 2016

Uh oh!

infograf768 commented Oct 9, 2016

Uh oh!

AlexRed commented Oct 9, 2016

Uh oh!

brianteeman commented Oct 9, 2016

Uh oh!

brianteeman commented Oct 9, 2016

Uh oh!

dgrammatiko commented Oct 9, 2016

Uh oh!

brianteeman commented Oct 9, 2016

Uh oh!

infograf768 commented Oct 9, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brianteeman commented Oct 9, 2016 via email

Uh oh!

infograf768 commented Oct 9, 2016

Uh oh!

infograf768 commented Oct 9, 2016

Uh oh!

brianteeman commented Oct 9, 2016

Uh oh!

infograf768 commented Oct 9, 2016

Uh oh!

AlexRed commented Oct 9, 2016

Uh oh!

infograf768 commented Oct 9, 2016

Uh oh!

dgrammatiko commented Oct 9, 2016

Uh oh!

AlexRed commented Oct 9, 2016

Uh oh!

dgrammatiko commented Oct 9, 2016

Uh oh!

wilsonge Oct 9, 2016

Choose a reason for hiding this comment

Uh oh!

infograf768 Oct 9, 2016

Choose a reason for hiding this comment

Uh oh!

infograf768 Oct 10, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

infograf768 Oct 10, 2016

Choose a reason for hiding this comment

Uh oh!

brianteeman commented Oct 11, 2016

Uh oh!

ggppdk commented Oct 11, 2016

Uh oh!

infograf768 commented Oct 11, 2016

Uh oh!

Hackwar commented Oct 15, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Hackwar commented Oct 15, 2016

infograf768 commented Oct 8, 2016 •

edited by joomla-cms-bot

Loading

AlexRed commented Oct 9, 2016 •

edited

Loading

infograf768 commented Oct 9, 2016 •

edited

Loading

infograf768 commented Oct 9, 2016 •

edited

Loading

infograf768 Oct 10, 2016 •

edited

Loading

Hackwar commented Oct 15, 2016 •

edited

Loading

infograf768 commented Oct 16, 2016 •

edited

Loading