getgrav / getgrav/grav-plugin-admin
Preview requires admin.pages
- Dominant language
- PHP
- Stars
- 377
- Forks
- 225
- Avg merge
- 11h 51m
- Merged PRs (30d)
- 4
Description
User with `admin.pages.read` and `admin.pages.update` privileges cannot see page preview while browsing/changing page markdown (403 is returned as /admin/media/contact.json/task:processmarkdown POST result). Adding whole `admin.pages` privilege makes preview to work ok.
Having `admin.pages.read` or `admin.pages.update` should be enough to see page preview probably.
Checked in 1.10.33.1.
Contributor guide
Research direction
Reproduce the 403 while previewing or changing page markdown, watching the /admin/media/contact.json/task:processmarkdown POST request with only admin.pages.read or admin.pages.update. Trace the permission check for that endpoint and compare it with the full admin.pages privilege. Done means either privilege permits preview without the broader permission and the existing behavior remains protected for unauthorized users.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- markdown, php
- Domain
- authorization, content
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100