Members can save entries with statuses to which they do not have access
shbchk opened this issue · comments
Permissions: members of the "Editors" group can edit their own entries and those of others, but they cannot access the "Open" status.
Expected behaviour:
Members of the "Editors" group can see and open all entries in the CP, including "Open" entries, but they are not allowed to save entries with "Open" status. If an entry has an "Open" status, in order to save edits, an Editor must change the status of the entry to something else that they can access. Preferably, channel's default status should be selected automatically.
Current behaviour:
Despite the status restrictions, all members are able to open, edit, and save entries with an "Open" status.
2024-06-13_17-34-08.mp4
EE 7.4.10
I could be wrong, but I think, this bug was introduced when the status dropdown got colors. It worked as expected before.
Ah- I do confirm. It throws the warning to change the status, but if you don't and you save, your edits 'stick' and it still has the Status they don't have permission to access.
I think at one point, this was simply intended behavior, but I won't swear to it. And given that it now throws a warning that you need to change the status but allows you to save anyway, that looks like a bug. Confirming it as such....
Example of warning message and going ahead saving anyway below.
