cityofaustin / cityofaustin/techstack
Permissions - revision history access via url
- Dominant language
- No language data
- Stars
- 11
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
From https://github.com/cityofaustin/techstack/issues/4102:
Exit criteria:
* As an author or publisher in a department accessing a revision history
* For a page in a different department
* I can't see it
* I can't replace the current draft
* I can't update/publish
Authors & Publishers can currently view the revisions if they access the url directly.
https://github.com/wagtail/wagtail/blob/88cff1f69e1ed32b4f5dfabe97ed98e35461b85d/wagtail/admin/views/pages.py#L1206
Acceptance Criteria:
authors / publishers are prevented from seeing the revision history, even if directly loading the link to the page
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in wagtail/admin/views/pages.py around line 1206, the linked revision-history entry point. Trace the existing department permission checks for authors and publishers, then verify that a direct revision-history URL for another department denies viewing, replacing the draft, and updating or publishing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100