processwire / processwire-issues

ProcessWire issue reports.
44 stars 2 forks source link

PageReference with user template: inconsistency between Profields Table and regular field when not superuser #1841

Open hiboudev opened 8 months ago

hiboudev commented 8 months ago
  1. A role has no access to user template,
  2. A PageReference targeted to user template (single page, Select list), inside a Profields Table => list is empty. I think this is expected?
  3. Another PageReference, same configuration, but outside a Profields Table => list is filled.

With a superuser, both lists are filled.

Something else I just found on permissions documentation: https://processwire.com/docs/user-access/permissions/#user-admin

If that doesn't bother you, could you tell me what is the purpose of user-view? I don't see any difference. And I just learn that a non-superuser role can search for players only if view permission is checked on user template for his role. I first thought I found a bug and am a bit confused. :)

ryancramerdesign commented 8 months ago

@hiboudev Table has its own, more basic implementation of Page fields, so there may be some small differences. If having selectable users in a Page field you'll want it to show them no matter who is editing the page, otherwise data could be lost on lower access edits. Instead limit access with standard page-edit permission to the page that has the field. So it may be that you need to add check_access=0 or include=all to the selector for finding users. I don't think there is a user-view permission, but there are optional and rarely used user-view-all, user-view-self and user-view-[role] permissions. If your purpose is a user selection field then I would stick with updating your selector instead though.

hiboudev commented 8 months ago

@ryancramerdesign I'm fine on my side, I added access control for some roles in user template and lists are working. I didn't have to add any permission.

I'm reporting because I think that should be consistent. If no, so I'll close.

I don't think there is a user-view permission

Sorry I mean user-view-*.