getgrav / getgrav/grav-plugin-admin

User not allowed to add a theme even though they have the permission

Open
#1,743 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
PHP
Stars
377
Forks
225
Avg merge
11h 51m
Merged PRs (30d)
4

Description

On my Grav instance with version 1.5.3, I created a user who is not super user but has the permission `admin.themes` enabled. When this user tries to add a theme from the admin interface, they get an error message corresponding to INSUFFICIENT_PERMISSIONS_FOR_TASK.

From what I understand of the documentation, `admin.themes` should be enough to add a theme: *allows a user to access the themes functionality, edit theme settings, change themes and add new ones*. I had a brief look at the code, and I think it is a bug. The class `AdminController` from the admin plugin checks whether the user has permission `'admin' . $type`, and the type sent by the UI is **theme** instead of **themes**. I tried to manually give the permission `admin.theme` to this user, and they can now add a new theme.

Contributor guide

Open the contributing guide

Research direction

Read the AdminController permission check described in the issue and compare the UI's `theme` value with the documented `admin.themes` permission. Reproduce the add-theme action with a non-superuser, then verify that granting `admin.themes` allows it without the insufficient-permissions error.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.