[5.2] Fix Permissions for Manually Running Scheduled Tasks by ditsuke · Pull Request #36719 · joomla/joomla-cms

ditsuke · 2022-01-17T15:21:44Z

Pull Request for Issue #36677.

Summary of Changes

Explicitly disables the "run task" button on insufficient authorization.
Adds tooltip to give context on disabling the button.
Change default permission level for running tasks/grant access to creator.
Prevent manual runs from being publicly accessible regardless of permission levels. Ref: #36453#issuecomment-1001793962 / @PhilETaylor

Testing Instructions

Create a new task with an administrator (not superuser) account.
Still as administrator, try to run it from the Scheduled tasks manager.
Try to run other tasks created by the super user.
Login as super user.
Check that you can run all tasks.
Thrash some task.
Check the trashed tasks.

Actual result BEFORE applying this Pull Request

As administrator (not superuser), there is no indication that the user is not authorized to run the task. The button is usable.
In all cases there is an error message.
Only a super user can run tasks.

Expected result AFTER applying this Pull Request

As administrator (not superuser):

The button is enabled for tasks created by yourself and you can run these tasks.
The button is disabled for tasks which were created by the super user (.e.g those from a new installation). Reason for being disabled is available through a tooltip on hover.

As super user buttons of all tasks are enabled, and you can run these tasks.

When a task is trashed, the button is disabled, and a tool tip shows the reason.

Documentation Changes Required

N/A

- Explicitly disables the "run task" button on insufficient authorization. - Adds tooltip to give context on disabling.

…run-task-btn-on-no-auth-36677'

brianteeman · 2022-01-17T15:34:48Z

How can it make sense for a user to be able to create a new task and setup lazy loading etc but not be able to run the task directly

ditsuke · 2022-01-17T15:42:46Z

How can it make sense for a user to be able to create a new task and setup lazy loading etc but not be able to run the task directly

Definitely, now that I think of it the creator should be able to run them manually as a default. I'll work on enabling that behavior before opening this PR.

brianteeman · 2022-01-17T15:49:15Z

Possibly need a new permission for that "Edit own"

Task creators should now be able to run them even if they do not have the `core.testrun` permission. The current permission checks should be reviewed.

ditsuke · 2022-01-17T16:42:07Z

administrator/components/com_scheduler/src/Scheduler/Scheduler.php

+	 *
+	 * @since __DEPLOY_VERSION__
+	 */
+	public static function isAuthorizedToRun(object $taskRecord, User $user): bool


@brianteeman what do you think about this check?

We need this field in the authorization check. Begs the question, should we just get all fields?

HLeithner · 2022-06-27T13:06:28Z

This pull request has automatically rebased to 4.2-dev.

HLeithner · 2023-05-02T16:30:43Z

This pull request has been automatically rebased to 4.3-dev.

HLeithner · 2023-09-30T22:45:38Z

This pull request has been automatically rebased to 4.4-dev.

HLeithner · 2024-11-15T13:22:48Z

This pull request has been automatically rebased to 5.2-dev.

richard67 · 2025-01-18T10:47:50Z

I was able to resolve the merge conflicts, which were mainly caused by PRs #40216 and #42746 .

It needs to be tested if this PR here and #42746 still work.

richard67 · 2025-01-18T13:39:06Z

I have tested this item ✅ successfully on eb813f6

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.}

dautrich · 2025-01-18T19:21:40Z

I have tested this item 🔴 unsuccessfully on eb813f6

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.}

dautrich · 2025-01-18T19:28:16Z

I've tested on J5.2.3 with a user belonging to user group "Administrator".

Without the patch applied, I was able to click on an existing task, but the task showed an error.
With the patch applied, the task execution button of the existing task were "greyed" out and showed a tooltip "Not authorized".
But with the patch applied, I was able to create additional tasks and run them:

richard67 · 2025-01-18T19:30:52Z

@dautrich Of course you shall be able to run your own tasks as user in the administrator group. And as administrator you shall also be able to create tasks. But the ones created by the super user are disabled. To me it seems it is workings as intended.

richard67 · 2025-01-18T19:33:18Z

P.S. Without the PR, one error is that you can not run tasks which you have created when you are an administrator. This is also fixed by this PR, that’s why you can create tasks and run them as administrator.

dautrich · 2025-01-18T19:33:37Z

Then the testing instructions seem to be misleading. It says: "Create a new task with an admin (not superuser) account." And that's what I did.

richard67 · 2025-01-18T19:34:26Z

Hmm I see the testing instructions are not precise.

richard67 · 2025-01-18T19:37:37Z

@dautrich I've updated the testing instructions. Thanks for the hint.

richard67 · 2025-01-18T19:41:51Z

P.S. I've updated again testing instructions and added a test for trashed tasks.

exlemor · 2025-01-18T20:15:51Z

I have tested this item ✅ successfully on eb813f6

I have tested this successfully.

(thanks for the updated testing instructions Richard!)

( Cool PR btw, thanks to all that made it possible ).

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.}

dautrich · 2025-01-18T20:48:59Z

I have tested this item ✅ successfully on eb813f6

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.}

richard67 · 2025-01-18T20:52:04Z

RTC

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36719.}

richard67 · 2025-01-18T20:52:36Z

Thanks for testing.

Hackwar · 2025-01-18T21:39:38Z

Thank you!

joomla/joomla-cms#44658 + joomla/joomla-cms#44712 - (только для др. пакетов) joomla/joomla-cms#39878 + joomla/joomla-cms#38536 + joomla/joomla-cms#36719 + joomla/joomla-cms#44753 + joomla/joomla-cms#44709 + joomla/joomla-cms#44793 - (только для en-GB)

Disable "run task" button on lack of authorization

2319119

- Explicitly disables the "run task" button on insufficient authorization. - Adds tooltip to give context on disabling.

joomla-cms-bot added Language Change This is for Translators PR-4.1-dev labels Jan 17, 2022

Merge branch '4.1-dev' of github.com:joomla/joomla-cms 'fix-disabled-…

ea7dc6a

…run-task-btn-on-no-auth-36677'

Allow creators of tasks the ability to run them

b306858

Task creators should now be able to run them even if they do not have the `core.testrun` permission. The current permission checks should be reviewed.

ditsuke commented Jan 17, 2022

View reviewed changes

Get created_by in default TasksModel query

bb3f253

We need this field in the authorization check. Begs the question, should we just get all fields?

richard67 mentioned this pull request Jan 18, 2022

[4.1 ScheduledTasks] Run Test or Run Task? #36453

Closed

HLeithner changed the base branch from 4.1-dev to 4.2-dev June 27, 2022 13:06

rdeutz added PR-4.2-dev and removed PR-4.1-dev labels Aug 1, 2022

Hackwar added Feature bug and removed Feature labels Apr 6, 2023

HLeithner changed the base branch from 4.2-dev to 4.3-dev May 2, 2023 16:30

alikon added PR-4.3-dev and removed PR-4.2-dev labels May 22, 2023

HLeithner changed the base branch from 4.3-dev to 4.4-dev September 30, 2023 22:45

laoneo added PR-4.4-dev and removed PR-4.3-dev labels Oct 2, 2023

HLeithner changed the title ~~[4.1] Fix Permissions for Manually Running Scheduled Tasks~~ [4.4] Fix Permissions for Manually Running Scheduled Tasks Apr 24, 2024

HLeithner changed the base branch from 4.4-dev to 5.2-dev November 15, 2024 13:22

HLeithner changed the title ~~[4.4] Fix Permissions for Manually Running Scheduled Tasks~~ [5.2] Fix Permissions for Manually Running Scheduled Tasks Nov 15, 2024

Fix PHPCS

b0261be

richard67 removed the PR-4.4-dev label Jan 18, 2025

richard67 added 3 commits January 18, 2025 11:25

Again PHPCS

b85b16d

One more PHPCS

2c8e3b5

And another PHPCS

19441a8

Merge branch '5.2-dev' into fix-disabled-run-task-btn-on-no-auth-36677

eb813f6

richard67 marked this pull request as ready for review January 18, 2025 12:51

joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Jan 18, 2025

Merge branch '5.2-dev' into fix-disabled-run-task-btn-on-no-auth-36677

23628dc

Hackwar enabled auto-merge (squash) January 18, 2025 21:14

Hackwar added this to the Joomla! 5.2.4 milestone Jan 18, 2025

Hackwar merged commit 0bb707c into joomla:5.2-dev Jan 18, 2025
3 of 4 checks passed

joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Jan 18, 2025

jgerman-bot mentioned this pull request Jan 19, 2025

[5.2] Fix Permissions for Manually Running Scheduled Tasks joomlagerman/joomla#3373

Closed

Uh oh!

Conversation

ditsuke commented Jan 17, 2022 • edited by richard67 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Testing Instructions

Actual result BEFORE applying this Pull Request

Expected result AFTER applying this Pull Request

Documentation Changes Required

Uh oh!

brianteeman commented Jan 17, 2022

Uh oh!

ditsuke commented Jan 17, 2022

Uh oh!

brianteeman commented Jan 17, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ditsuke Jan 17, 2022

Choose a reason for hiding this comment

Uh oh!

HLeithner commented Jun 27, 2022

Uh oh!

HLeithner commented May 2, 2023

Uh oh!

HLeithner commented Sep 30, 2023

Uh oh!

HLeithner commented Nov 15, 2024

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

dautrich commented Jan 18, 2025

Uh oh!

dautrich commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

dautrich commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

exlemor commented Jan 18, 2025

Uh oh!

dautrich commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

richard67 commented Jan 18, 2025

Uh oh!

Hackwar commented Jan 18, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

ditsuke commented Jan 17, 2022 •

edited by richard67

Loading

brianteeman commented Jan 17, 2022 •

edited

Loading

richard67 commented Jan 18, 2025 •

edited

Loading