Permission denied is raised, although user has permission to edit the page

[jrief]

This happens in CMS4 branch develop-4 (650f31a80f9c3a579d40f201477f546ca663e88e) in combination with djangocms-versioning (adce88065509c84212e432c41c05a121c246ed1f also latest).

In some situations a permission denied exception is raised, although the user has permission to edit that page. This happens when the user attempts to accessing the page settings editor.

How to reproduce:

• Take a page with at least two versions.
• In Django admin, open the page versioning list view, ie. the URL shall be something like: /en/admin/djangocms_versioning/pagecontentversion/?page=8943&language=en. Replace page=… against a valid Page-ID.
• If there is at least one draft version of the page, this error does not occur – you can test by clicking into the breadcrumb onto the element preceding "Versions".
• Now remove the draft version for that page by clicking onto the trash symbol and confirm.
• The URL should be the same as before. In the list view of versions there should only be versions in state "published", "unpublished" and "archived".
• Now click onto the breadcrumb into the element preceding "Versions".
• This raises a permission denied exception.

Expected behaviour

A user does not expect a permission denied exception, since he has permissions to edit the page.

[fsbraun]

Does the permission denied message also appear if you click on the settings icon in the page tree if there is no draft version of the page?

OK, I just reproduced this, and the answer is yes.

[fsbraun]

Found the issue:

• django CMS core does not provide a has_view_permission for the page content's admin class
• The has_change_permission is overwritten to account for publishing status
• As a result, only the overwritten permission is applied - also to viewing the page settings

Patch is coming up

[jrief]

Does the permission denied message also appear if you click on the settings icon in the page tree if there is no draft version of the page?

Yes, in the page tree view I can reproduce this by clicking on the "page settings" icon.

[jrief]

This pull request fixes the problem: https://github.com/django-cms/django-cms/pull/7921