Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-28934

LocationService doesn't check content/manage_locations policy during location create

    XMLWordPrintable

Details

    Description

      Steps to reproduce:

      1. Create content structure as follow:
        1. Root/Folder1
        2. Root/Folder2
      2. Create an article (e.g. ArticleA) in Root/Folder1
      3. Create new user group (e.g. Contributors)
      4. Create new user in Contributors group
      5. Add all policies which are required to be able to work with PlatformUI/BO (user/login, content/read, etc.)
      6. Add content/{create,publish,remove,versionread,versionremove policy with Subtree limitation on /Root/Folder2/
      7. Go to ArticleA and add the new location under /Root/Folder2.

      Current behavior:
      The user can create the new location, but can't remove it.

      Expected behavior (according to Legacy):
      As in legacy, content/manage_locations policy should be checked and a user shouldn't be able to create the new location without it.

      sylvain.guittard@ez.no what do you think about this change? Should we change it and make it work as it was in Legacy? This change might be problematic for the customers because all of them will need to update policies (add the new one content/manage_locations) if they want to make editors allowed to add a new location.

      Attachments

        Activity

          People

            Unassigned Unassigned
            kamil.madejski@ibexa.co Kamil Madejski
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: