dotCMS / dotCMS/core

Upload New File: Permissions and Error Messaging

Open
#34,896 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

OKR : Customer Support stale Team : Maintenance
Dominant language
Java
Stars
970
Forks
486
Avg merge
3d 33m
Merged PRs (30d)
170

Description

Problem Statement

From the dotCMS backend, I would like to prevent content editor from being able to access and use the "Upload New File" button from within an image field in a content type. If I don't give any permissions to content editors to the default File Asset content type, I would expect them to get an error message when they attempt to do so. However, current behavior is that it will appear content editors are able to upload an image, no error is shown, but no image ever gets uploaded. It's good the image is not uploaded, since the content editor doesn't have permissions, but this is confusing behavior as the user has no indication of an error and would continuously try to keep uploading the image.

Image Image
Steps to Reproduce

Here is a short video demonstrating the issue: https://drive.google.com/file/d/1uGjgcstMzUCaTuv1dtNttpdM0HFXxj2a/view?usp=sharing

Acceptance Criteria
  • I would expect an error message to appear when unable to upload an image due to permissioning
dotCMS Version

latest, dotevergreen

Severity

Low - Minor issue or cosmetic

Links

N/A

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Upload New File flow from an image field as a content editor without permissions on the default File Asset content type. Trace the permission failure and verify that the UI displays an error when the image cannot be uploaded; the acceptance criterion is a clear error message instead of a silent failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.