actionmenu.js : editLink is shown when user does not have edit permission
Open
Nobody has claimed this yet.
01 type: bug
31 needs: help
99 tag: Plone 5.x
- Dominant language
- JavaScript
- Stars
- 57
- Forks
- 103
- Avg merge
- 10h 25m
- Merged PRs (30d)
- 18
Description
E.g. for a user with reviewer role but not edit role they see the edit icon (a pencil) in folder_contents ....
but when they follow it they get "insufficient priviledges"
This is an issue for us in Plone 5.1.6, but is also an issue in Plone 5.2.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in actionmenu.js and trace how folder_contents decides whether to show editLink for users with reviewer access but no edit permission. Reproduce the behavior with those permissions and verify that the edit icon is hidden while users with edit permission can still follow it successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100