Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.x] Always detach localizations when user is missing permissions to delete in other sites #10587

Merged

Conversation

duncanmcclean
Copy link
Member

This pull request fixes an issue where it was possible for users to delete localized entries in other sites, even if they don't have permissions to access that site.

Fixes #10519.

We're already forgetting this key in the `deleteDescendants` method above.

Without doing it here too, the action will error out when deleting the actual entry, since it thinks the localizations are still attached.
src/Actions/DeleteMultisiteEntry.php Outdated Show resolved Hide resolved
src/Actions/DeleteMultisiteEntry.php Outdated Show resolved Hide resolved
@jasonvarga jasonvarga merged commit 3f86e54 into 5.x Aug 8, 2024
17 checks passed
@jasonvarga jasonvarga deleted the prevent-deleting-entries-in-other-sites-without-permission branch August 8, 2024 18:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unauthorized deletion of entries in multi-site setup
2 participants