adobe / aem-core-wcm-components

Standardized components to build websites with AEM.
https://docs.adobe.com/content/help/en/experience-manager-core-components/using/introduction.html
Apache License 2.0
723 stars 737 forks source link

Teaser image allows upload even when Image design policy does not #2767

Open HitmanInWis opened 1 month ago

HitmanInWis commented 1 month ago

Bug present as of version: 2.24.7-SNAPSHOT

The Teaser component includes the Image dialog tab and uses com.adobe.cq.wcm.core.components.internal.servlets.ImageDelegatePolicyServlet to use the design policy for the Image component when rendering the tab on the dialog. This works for most cases, such as show/hide of the "Disable lazy loading" field with granite:hide="${cqDesign.disableLazyLoading}" based on the Image policy. However, the allowUpload property seems to still be driven by a setting on the Teaser component policy, not the Image component policy.

To reproduce:

I can verify the teaser policy is used for allowUpload b/c if I manually add allowUpload=false to the teaser policy then uploading an asset on my teaser is disallowed.

This is a bit hidden of a bug b/c technically the Image component doesn't have an allowUpload value in the WCM Core design dialog by default - the AEM archetype is just simply adding it to the configured image policy. However, this option is a good option to have, b/c it is often desirable on AEM to disallow uploading assets directly to a component (assets should be in the DAM), and I'm not sure there's any other good way to disable uploading assets other than overwriting the Image component dialog.