Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-31018

Content with relation to different Content that user does not have permission to read will break Backoffice

    XMLWordPrintable

Details

    Description

      When Content A has a relation pointing to the Content B and active User tryies to view/edit Content A without permissions to read Content B 500 exception will be thrown:

      HTTP 500 Internal Server Error
      An exception has been thrown during the rendering of a template ("User does not have access to 'read' 'content' with: contentId '58'") in "@admin/fieldtypes/preview/content_fields.html.twig".

      Steps to reproduce
      1. Clean installation of eZ Platform 2.5.6
      2. Log into the backoffice as admin.
      3. Create a new Content Type Content With Relation containing ezrelation field.
      4. In Home create and publish Folder Folder A.
      5. In Home create and publish Folder Folder B.
      6. In Folder B create and publish Article Test Article.
      7. In Folder A create and publish Content With Relation Test with relation to Test Article.
      8. Edit Editor Role:

      Module Function Limitation
      User Login None
      Url * None
      Content Read Subtree of Location: /Home/Folder A
      Content Read Location: /Home
      Content Versionread None
      Content Edit None
      Content View_embed None

      9. Create Editor user in Editors Group.
      10. Log in to the backoffice as Editor.
      11. In Content Structure go to Test

      Result
      In dev:

      HTTP 500 Internal Server Error
      An exception has been thrown during the rendering of a template ("User does not have access to 'read' 'content' with: contentId '58'") in "@admin/fieldtypes/preview/content_fields.html.twig".

      In prod:
      Partially rendered page with not working buttons.

      Expected Result
      Content view of Test opens normally.

      Attachments

        Activity

          People

            Unassigned Unassigned
            mateusz.bieniek@ibexa.co Mateusz Bieniek
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: