getgrav / getgrav/grav-plugin-admin
User not allowed to add a theme even though they have the permission
- Dominant language
- PHP
- Stars
- 377
- Forks
- 225
- Avg merge
- 11h 51m
- Merged PRs (30d)
- 4
Description
On my Grav instance with version 1.5.3, I created a user who is not super user but has the permission `admin.themes` enabled. When this user tries to add a theme from the admin interface, they get an error message corresponding to INSUFFICIENT_PERMISSIONS_FOR_TASK.
From what I understand of the documentation, `admin.themes` should be enough to add a theme: *allows a user to access the themes functionality, edit theme settings, change themes and add new ones*. I had a brief look at the code, and I think it is a bug. The class `AdminController` from the admin plugin checks whether the user has permission `'admin' . $type`, and the type sent by the UI is **theme** instead of **themes**. I tried to manually give the permission `admin.theme` to this user, and they can now add a new theme.
Contributor guide
Research direction
Read the AdminController permission check described in the issue and compare the UI's `theme` value with the documented `admin.themes` permission. Reproduce the add-theme action with a non-superuser, then verify that granting `admin.themes` allows it without the insufficient-permissions error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100