Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-20949

Fatal error on versionview permission check

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Medium Medium
    • Resolution: Fixed
    • Affects Version/s: 4.7.0, 5.0, 5.1
    • Fix Version/s: Customer request, 4.7.0, 5.0, 5.1
    • Component/s: Permissions
    • Labels:
      None
    • Environment:

      eZ Publish 4.7

      Description

      Attempting to versionview an object's first version draft, for which user has no full privileges, results in a fatal error, if the container of the object has been removed.

      Steps to reproduce:
      • create a new section: my_restricted
      • create a role assigning privileges to create, read, versionview, assign section for this new section
      • create 1 editor users - editor_restricted. assign this new role (together with the basic editor role)
      • create 1 editor user - editor. assign the basic editor role alone
      • create a folder and assign it to section my_restricted
      • logged in as editor_restricted, create an article, within this folder and store it as a draft
      • on a different browser open the correspondent versionview/<objectid>/1/language, logged in with the regular editor user
      • remove the container folder
      • refresh the versionview page, with the regular editor user
      • result: fatal error while trying to verify if user has privileges to access to the object's parent.
      • accessing the versionview page with the user that has full permissions doesn't result in fatal error, since no checkAccess on parent is attempted

        Issue Links

          Activity

          Hide
          Joao Pingo (Inactive) added a comment - - edited

          @Jérôme
          I've run the tests and i'm not getting the expected results

          1. Add a new section
          2. Create a new role to read, create and versionread the content of the new section
          3. Create two editors, assign the new role to one of them
          4. Create a folder and assign it to the new section
          5. Using the editor, assigned with new role, create an article under the folder, but don't publish it, use "store draft and exit"
          6. Using the other editor, login and view the draft using content/versionview/<article object id>/1/language
          7. Remove the folder using admin user
          

          After this i get the following results
          As admin -> accessing content/versionview/<article object id>/1/language show the article draft
          As editor and editor_restricted -> i'm getting the following error on GUI

          The requested page could not be displayed. (1)
          The system is unable to display the requested page because of security issues.
          Possible reasons:
          Your account does not have the proper privileges to access the requested page.
          The requested page does not exist. Try changing the URL.
          

          Show
          Joao Pingo (Inactive) added a comment - - edited @Jérôme I've run the tests and i'm not getting the expected results 1. Add a new section 2. Create a new role to read, create and versionread the content of the new section 3. Create two editors, assign the new role to one of them 4. Create a folder and assign it to the new section 5. Using the editor, assigned with new role, create an article under the folder, but don't publish it, use "store draft and exit" 6. Using the other editor, login and view the draft using content/versionview/<article object id>/1/language 7. Remove the folder using admin user After this i get the following results As admin -> accessing content/versionview/<article object id>/1/language show the article draft As editor and editor_restricted -> i'm getting the following error on GUI The requested page could not be displayed. (1) The system is unable to display the requested page because of security issues. Possible reasons: Your account does not have the proper privileges to access the requested page. The requested page does not exist. Try changing the URL.
          Hide
          Jérôme Vieilledent (Inactive) added a comment -

          Joao Pingo: This is the result expected. It's not really possible to display another kind of message. However there is a more explicit log in error.log.

          Show
          Jérôme Vieilledent (Inactive) added a comment - Joao Pingo : This is the result expected. It's not really possible to display another kind of message. However there is a more explicit log in error.log.
          Hide
          Joao Pingo (Inactive) added a comment -

          Changed the TC's for the described behaviour
          Created improvement story EZP-21342
          Tested using tc 1712 and 1714 on master and 4.7 (client)
          Tests Passed ... QA Done

          Show
          Joao Pingo (Inactive) added a comment - Changed the TC's for the described behaviour Created improvement story EZP-21342 Tested using tc 1712 and 1714 on master and 4.7 (client) Tests Passed ... QA Done
          Hide
          Gunnstein Lye added a comment -

          Reopened for QA on 5.0 and 5.1

          Show
          Gunnstein Lye added a comment - Reopened for QA on 5.0 and 5.1
          Hide
          Pedro Resende (Inactive) added a comment -

          Tested and approved by Q.A. on 5.0 and 5.1

          Show
          Pedro Resende (Inactive) added a comment - Tested and approved by Q.A. on 5.0 and 5.1

            People

            • Assignee:
              Unassigned
              Reporter:
              Joaquim Cavalleri (Inactive)
            • Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 2 days, 3 hours
                2d 3h