Opened 2 years ago
Closed 2 years ago
#2672 closed Defect (fixed)
Pages plugin: Creating a subpage results in an error if top-level page is owned by other user
| Reported by: | iionly | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Elgg 1.8.0 |
| Component: | Pages | Version: | 1.7 |
| Severity: | minor | Keywords: | sup-pages, pages |
| Cc: | brettp | Difficulty: | moderate |
Description
Elgg 1.7.4:
I'm not sure if it's intended to allow creation of sub-pages below top-level pages of other users. Creation of sub-pages works, if the top level page is owned by the same user.
But when creating a sub-page with another user's account it results in the error:
IOException
Unable to save new object's base entity information!
This error appears only after trying to save the created sub-page.
If the creation of the sub-page shouldn't be possible, it might be better to not show the option to create it in the first place.
Change History (6)
comment:1 Changed 2 years ago by cash
- Difficulty set to easy
- Milestone changed from Needs Review to Elgg 1.7.7
comment:2 Changed 2 years ago by cash
- Resolution set to fixed
- Status changed from new to closed
(In [svn:7924]) Fixes #2672 creating subpages is restricted
comment:3 Changed 2 years ago by iionly
- Resolution fixed deleted
- Status changed from closed to reopened
I think the problem with deleting pages created by other users is also still unresolved.
When looking at the fix I noticed that this issue might also can resolved in the same way, i.e. by moving the lines
$delete_url = elgg_add_action_tokens_to_url("{$CONFIG->wwwroot}action/pages/delete?page={$pages->getGUID()}");
add_submenu_item(elgg_echo('pages:delete'), $delete_url, 'pagesactions', true);
from if ($pages->canEdit()) to the new if clauses created with fix [svn:7924].
comment:4 Changed 2 years ago by cash
- Resolution set to fixed
- Status changed from reopened to closed
(In [svn:7964]) Fixes #2672 deleting pages is now also controlled more tightly
comment:5 Changed 2 years ago by brettp
- Difficulty changed from easy to moderate
- Milestone changed from Elgg 1.7.7 to Elgg 1.8
- Resolution fixed deleted
- Status changed from closed to reopened
Reopening for 1.8 since this doesn't look like it will merge directly because of the shared entity control panel.
comment:6 Changed 2 years ago by cash
- Resolution set to fixed
- Status changed from reopened to closed
(In [svn:9170]) Fixes #2672 limiting deleting pages and creating sub pages

Users should not be able to create subpages on anther user's pages. If they need to do that, they should create a group.
We need to update the logic to not depend on canEdit() when deciding whether to show the add sub-page link.