Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-28934

LocationService doesn't check content/manage_locations policy during location create

    XMLWordPrintable

    Details

      Description

      Steps to reproduce:

      1. Create content structure as follow:
        1. Root/Folder1
        2. Root/Folder2
      2. Create an article (e.g. ArticleA) in Root/Folder1
      3. Create new user group (e.g. Contributors)
      4. Create new user in Contributors group
      5. Add all policies which are required to be able to work with PlatformUI/BO (user/login, content/read, etc.)
      6. Add content/{create,publish,remove,versionread,versionremove policy with Subtree limitation on /Root/Folder2/
      7. Go to ArticleA and add the new location under /Root/Folder2.

      Current behavior:
      The user can create the new location, but can't remove it.

      Expected behavior (according to Legacy):
      As in legacy, content/manage_locations policy should be checked and a user shouldn't be able to create the new location without it.

      Sylvain Guittard what do you think about this change? Should we change it and make it work as it was in Legacy? This change might be problematic for the customers because all of them will need to update policies (add the new one content/manage_locations) if they want to make editors allowed to add a new location.

        Attachments

          Activity

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            kamil.madejski@ez.no Kamil Madejski
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: