Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-17219

Policy "section/assign" does not uphold subtree limitation

    Details

      Description

      eZ Publish allows you to limit roles (hence also policies) to only be active in subtrees of the content tree. However this limitation does not work for the "Section/Assign" policy.

      Instead a user with a "Section/Assign" policy can assign sections to any node regardless of subtree limitations. See steps to reproduce for an example.

      Steps to reproduce

      As admin Create two new roles:

      1. A role called "basic role" with unlimited "Content/Read" and unlimited "User/Login"
      policies.

      2. Another role called "section role" with unlimited "Section/Assign" and unlimited
      "Section/View".

      3. Create a user group and a test user in it. Call the user "tester".

      4. Assign "basic role" to "tester".

      5. Click "Setup" -> "Roles and policies". Click on the "section role" role. Choose
      "subtree" from the dropdown and click the "Assign with limitation" button.

      6. Choose a content node and then the "tester" user when asked.

      7. Log out as admin, login as "tester".

      8. Click "Setup" -> "Sections".

      9. From here you can assign any section to any node, when in fact you should only
      be able to assign a section to the node you chose in (6).

        Issue Links

          Activity

          Show
          Patrick Allaert added a comment - Fixed in: eZ Publish 4.5: https://github.com/ezsystems/ezpublish/commit/cef569909821cbf393620244ba48a14328b88c53 eZ Publish 4.4: https://github.com/ezsystems/ezpublish/commit/f501f586be177710660568d144ce1f0149d49527 eZ Publish 4.3: https://github.com/ezsystems/ezpublish/commit/29c912a62008a83360f4c00bae06d03bb93136f2 eZ Publish 4.2: https://github.com/ezsystems/ezpublish/commit/bacd69c882f8c19237b1b2fd113dc3a62739895e eZ Publish 4.1: https://github.com/ezsystems/ezpublish/commit/e4fe8a1f06715776b20bfd0ad94825f9fe8791e4 eZ Publish 4.0: https://github.com/ezsystems/ezpublish/commit/4d1f491eb2df7e999aa9679d2e1b1f635eb0d395
          Hide
          Geir Arne Waaler added a comment -

          The issue is fixed. I hence move it from Code Review to Closed.

          Geir Arne Waaler
          eZ Documentation

          Show
          Geir Arne Waaler added a comment - The issue is fixed. I hence move it from Code Review to Closed. Geir Arne Waaler eZ Documentation

            People

            • Assignee:
              Patrick Allaert
              Reporter:
              Disabled User
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: