Skip to content

Conversation

@heelc29
Copy link
Contributor

@heelc29 heelc29 commented Dec 24, 2022

Summary of Changes

The permission for show the quickicon and the link/ajax do not match (com_installer vs. com_templates)

if ($context !== $this->params->get('context', 'update_quickicon') || !$this->app->getIdentity()->authorise('core.manage', 'com_installer')) {
return array();
}
$token = Session::getFormToken() . '=1';
$options = array(
'url' => Uri::base() . 'index.php?option=com_templates&view=templates',
'ajaxUrl' => Uri::base() . 'index.php?option=com_templates&view=templates&task=template.ajax&' . $token,
'pluginId' => $this->getOverridePluginId(),
);

Testing Instructions

Check the admin dashboard with a user with these permissions:
image

Actual result BEFORE applying this Pull Request

Ajax request get 403 status (forbidden)
image
image

When you click on the quickicon
image

Expected result AFTER applying this Pull Request

The quickicon is no longer displayed

Now if you swap permissions for com_installer/com_templates, the quickicon works correctly:
image
image

Link to documentations

Please select:

  • No documentation changes for docs.joomla.org needed
  • No documentation changes for manual.joomla.org needed

@carlitorweb
Copy link
Member

I have tested this item ✅ successfully on 9427139

Note: For get the right permission the test require, is enough with create a user under Registered group and add the "Access Administration Access" from the global configuration permissions. From there you can follow the test indication.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39485.

@viocassel
Copy link
Contributor

I have tested this item ✅ successfully on 9427139


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39485.

@Quy
Copy link
Contributor

Quy commented Dec 28, 2022

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39485.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Dec 28, 2022
@roland-d roland-d merged commit 6ae3826 into joomla:4.2-dev Dec 29, 2022
@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Dec 29, 2022
@roland-d
Copy link
Contributor

Thank you

@roland-d roland-d added this to the Joomla! 4.2.7 milestone Dec 29, 2022
@heelc29 heelc29 deleted the 4.2/plugins/quickicon/overridecheck branch December 30, 2022 17:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants