search

spanner / radiant-multi-site-extension

An extension for Radiant CMS that lets you serve multiple sites (domains) from a single instance, with flexible scoping of other models to sites.
17 stars 6 forks source link

Permission bug for "user" sites tab usable for non admin users #3

Open rubytastic opened 14 years ago

rubytastic commented 14 years ago

When logged in as regular user ( not designer/admin) The "Sites" tab is visible and accesible in the admininterface It is possible to change the other sites.

This tab should not be visible, any login that is not admin should not be able to edit the sites config.

spanner commented 14 years ago

it shouldn't do that. are you in 0.9?

rubytastic commented 14 years ago

Yes Using Radiant Edge 0.9.x version On OSX with latest ruby and rails

andrewreid commented 14 years ago

I think it's to do with the access control change in 0.9.x - add_item doesn't respond to any access control instructions, and admin.tabs.add doesn't get called (because the new Admin UI API is invoked in the if respond_to?(:tab) block.

I've sent a small patch to spanner with the code in the controller as per 0.9 convention. I don't know what this means for the plugin when using an earlier version of Radiant, however.

spanner commented 14 years ago

Thanks. There's a lot of work coming up on multi_site but I'll get that change in as soon as I can.

will