Trash manager purging of resources assigned to resource group only working for sudo user

modxcms / revolution

MODX Revolution - Content Management Framework

https://modx.com/

GNU General Public License v2.0

1.36k stars 529 forks source link

Trash manager purging of resources assigned to resource group only working for sudo user #14339

Open travisbotello opened 5 years ago

travisbotello commented 5 years ago

Bug report

Summary

Trash manager purging of resources assigned to resource group only working for sudo user.

Step to reproduce

Create a new user without sudo flag
Add this user to Administrator group and assign Super User role
Create a new resource group and grant access to Administrator group
Login with this new user
Create a new document and assign it to new resource group
Delete this resource
Go to trash manager
Hit purge all

Observed behavior

Resources are not purged. Success message is shown:

Success! Nothing was purged, no errors occurred.

Expected behavior

Resources should be purged.

Environment

MODX 2.7.0 advanced

crimsonpixel commented 4 years ago

I am experiencing issues with the Trash Manager too. I have various clients who has specific permissions assigned to them via ACLs and whilst some seem to be able to remove resources from the Trash Manager others do not. Permissions to access Trash Manager and purge resources and delete resources are checked but for some this doesn't appear to make any difference and resources remain in place. As @travisbotello states if you give a user Sudo status then suddenly they can empty the Trash Manager but obviously that isn't ideal.

wax100 commented 4 years ago

The problem is (as I understand) in line 130 , file \core\model\modx\processors\resource\trash\getlist.class.php $canEdit = $this->modx->hasPermission('edit'); I can't find permission EDIT, we have only SAVE Thats why clients do not see context menu on manager/?a=resource/trash page

travisbotello commented 4 years ago

Excellent observation. When adding edit permission manually to the admin template and activating this in the policy purging is working as expected without sudo flag. However I'd suggest that the policy should be renamed to something more specific like edit_trash or can_purge. We have some edit_* permissions which are more specific.