Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default "Content Author" group does not have file edit permissions #276

Open
chillu opened this issue May 22, 2019 · 0 comments
Open

Default "Content Author" group does not have file edit permissions #276

chillu opened this issue May 22, 2019 · 0 comments

Comments

@chillu
Copy link
Member

chillu commented May 22, 2019

In 3.x, access to the assets section (CMS_Access_AssetAdmin) or the CMS (CMS_Access_LeftAndMain) was enough to edit files. Which meant the default "Content Author" group could edit all files, which makes sense. See https://github.com/silverstripe/silverstripe-framework/blob/3/filesystem/File.php#L338

In 4.x, we've significantly increased the complexity of the file permission model (see file security makes no sense and docs update.

Editing files now requires the FILE_EDIT_ALL permission, unless other permissions are set (e.g. giving access to certain groups). I consider this a regression from 3.x, and a default that doesn't make any sense. It leads to further confusions like @kinglozzer looking at the ownership of a file for permission control (comment).

We should mention this in the 4.0 and 4.5 upgrading guide, and change the default Group->requireDefaultRecords() to add this permission for new installs.

/cc @tractorcow @sminnee @dnsl48

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants