apostrophecms / apostrophecms/apostrophe

Users without edit permissions can be set as editors for a page

Open
#1,414 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
4.6k
Forks
650
Avg merge
19h 21m
Merged PRs (30d)
23

Description

In the Permissions tab of a page, when you use the "These Users can Edit" field to add editors for the page, you have the option to add any user. That includes users who only have `guest` permissions. Only users with the ability to edit a page/piece should be available to add as editors.

Contributor guide

Open the contributing guide

Research direction

Start in the Permissions tab implementation and trace how the “These Users can Edit” field filters users by permission. Done means guest-only users cannot be selected, while users who can edit a page or piece remain available; verify the page editor flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authorization, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.