290633 - Access Denied for all edit version pages & edit extension details page

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[James Ross]

After logging in, going to ChatZilla listing, adding two new versions (currently
pending approval), I tried to view the listmanager's editversion page. It gives
Access Denied messages for every single version, including the two I just added.

Also, it shows nothing next to "Permissions:" in My Profile, which may be related.

Seems to als give the error for editmain too, so it may well be that you guys
didn't set up the permissions yet/properly. ;)

Either way, it is broken.

Comment 1

[alanjstr]

It has to do with your role being developer, so its a php problem.  As an Admin,
I can see it just fine.

Comment 2

[Wolf [:wolf]]

This appears to be a regression from Bug 279398.

Listmanager isn't just for admins. It probably should be, but.

http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&root=/cvsroot&subdir=mozilla/webtools/update/developers&command=DIFF_FRAMESET&file=listmanager.php&rev2=1.7&rev1=1.6

Unfortunately, that bug doesn't give alot of detail as to why the change was
made, but an incorrect assumption was definitely used, as listmanager isn't just
for admins *at all*

Comment 3

[Jens Bannmann]

*** Bug 290662 has been marked as a duplicate of this bug. ***

Comment 4

[alanjstr]

The functions in this file are:
$function=="editmain"
$function=="editversion"
and !$function

listmanager should be split into two files, listmanager (the admin thing) and
edititem which will have checks to make sure that the user has permission to
edit it.

Comment 5

[Wolf [:wolf]]

The code rearchitection probably should wait for another bug. Was there actually
a real bug involved in changing the if that regressed this. listmanager has no
admin-specific functions.

If the issue was that editors were being granted full-list rights, then simply
change the if to read. (based on versoin 1.6)

From:
if ($_SESSION["level"] !=="admin" and $_SESSION["level"] !=="editor") {

To:
if ($_SESSION["level"] !=="admin") {

so it'll execute the "does this belong to you" check for editors too. :-)

Comment 6

[alanjstr]

Attachment: If non-admin, can only edit their own

Comment 7

[Michael Morgan [:morgamic]]

Comment on attachment 181501 [details] [diff] [review]
If non-admin, can only edit their own

Patch works as described.

Comment 8

[alanjstr]

Landed into CVS