silverstripe / silverstripe-elemental

Create pages in Silverstripe CMS using content blocks
http://dna.co.nz
BSD 3-Clause "New" or "Revised" License
110 stars 115 forks source link

Pages with an ElementalArea can't be published by non-admins #156

Closed KINKCreative closed 6 years ago

KINKCreative commented 7 years ago

You don't see an issue when logged in as admin, but as non-admins, one isn't able to publish a page when Elements are added to it.

Theory:

Because the Page is set to $owns the ElementalArea by the provided extension, the Page will try to publish the ElementalArea. The ElementalArea by default has no canPublish method / canEdit methods and publishing such pages as a non-admin will throw the error that "the user can't publish the ChangeSet" (along those lines).

I fixed it with this:

<?php

use SilverStripe\ORM\DataExtension;
use SilverStripe\Security\Permission;

class ElementalAreaPublishExtension extends DataExtension {

  public function canPublish($member = NULL) {
    return Permission::checkMember($member, "CMS_ACCESS");
  }

}

This is for SS 4.

robbieaverill commented 7 years ago

Thanks for reporting. I'd like to see some unit tests make their way in when a change like this gets made. If you're interested in having a crack at it, that's be great! You could use the blog module tests as an example, there's a few in there related to permissions

bummzack commented 6 years ago

I've noticed this too. But since you can't view/edit/delete any DataObject by default, there's currently no other way than adding an extension with relaxed permissions like you did (also required for viewing/editing the elemental-blocks).

Ideally, there would be an additional set of permissions for content blocks?

NightJar commented 6 years ago

Possibly related to https://github.com/symbiote/silverstripe-advancedworkflow/issues/333 in some manner