apostrophecms / apostrophecms/apostrophe
Users without edit permissions can be set as editors for a page
Open
bug
- Dominant language
- JavaScript
- Stars
- 4.6k
- Forks
- 650
- Avg merge
- 19h 21m
- Merged PRs (30d)
- 23
Description
In the Permissions tab of a page, when you use the "These Users can Edit" field to add editors for the page, you have the option to add any user. That includes users who only have `guest` permissions. Only users with the ability to edit a page/piece should be available to add as editors.
Contributor guide
Research direction
Start in the Permissions tab implementation and trace how the “These Users can Edit” field filters users by permission. Done means guest-only users cannot be selected, while users who can edit a page or piece remain available; verify the page editor flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- authorization, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100