4.5 Users unable to modify layouts created by other users while having full folder permission

CMS Version

Xibo CMS 4.5.0

Issue

After updating to 4.5.0 users are no longer able to modify layouts created by other users within the same folder.

The way we have set up permissions is as follows:

  • We have a folder for each building
  • For each folder, we have a user group that is given full permission to only that folder. No features are set, only sharing permission to create, modify and delete.
  • All users are in a default group that determines which features they have access to.
  • Each user is added to one or more user groups that allows them to manage one or more buildings

Before 4.5.0 users were able to modify everything in that folder, including layouts made by other users and myself (Administrator), even if that item wasn’t shared with the user(groups)

Since 4.5.0 users only have permission to create, modify and delete the things they are the owner of within that group. Other users do not have the possibility to make any changes to it.

Requesting each user to share their lay-out every time they create a new one is not the way we would like to move forward.

Steps to reproduce

  1. Boot up a fresh Docker installation
  2. Create a new user group (TestGroup)
  3. Create a new folder (TestFolder)
  4. Share TestFolder with TestGroup, with create modify and delete permissions.
  5. Create a new user (TestUser) and make it a content manager
  6. Assign TestGroup to the TestUser
  7. As an Administrator, create a lay-out in the TestFolder and publish it.
  8. Sign-in as TestUser, head to layouts, and open the TestFolder.
  9. Notice how TestUser does not have any permissions to your layout, despite having full access.

It looks like it may have been moved to a different place, but changing any permissions there appears not to be working.

  1. Head to the users page
  2. Select any user and open their user settings.
  3. Navigate to the “Folder permission” tab
  4. Give the user “Full access” to one or more folders.
  5. Click save

However, the problem here is that changing these permissions actually does not get saved. When you repeat the steps above, you can see that all the checkboxes you checked, are unchecked.

In both Xibo CMS 4.5.0 and Xibo CMS 4.5.1 this issue is present

Hi MrStefan,

Thank you for reaching out to Xibo Community!

My name is Jerry from one of the support team. I have replicated the steps you have provided on a CMS V4.5.1 and I can see that the folder permissions are working as expected. Could you please try the below steps and check if it works for you?

User Group Permissions.
Replication Steps:

1. Tested in cloud CMS V4.5.1 https://jerryupdatedcms.xibo.co.uk/

2. Create a new user group (TestGroup).

Features enabled are for ‘Folder’ and ‘Layout’ management.

3. Create a new user (TestUser, with user type set as ‘User’). No features enabled for this user as it will be inherited from the TestGroup user group.

4. Add TestUser to TestGroup user group

5. Create a new folder (TestFolder)

6. Share TestFolder with TestGroup, with create modify and delete permissions.

7. As an Administrator, create a layout called ‘User Permission Test’ in the TestFolder and publish it.

8. Log in as the TestUser and confirm that the folder is there with the layout created in it.

Confirm if the folder has view (you should see the layout inside the folder), edit and delete permissions.

Important!
Please click the small folder icon to view the folder tree and then select the correct folder that is shared to the user.

The same is also working if you share the folder with the TestUser.

Logged in as Admin and shared the folder to the TestUser

Logged in as the TestUser and can still view, edit and delete the layout.

Kind regards,

Jerry

I have went ahead and made a screenrecording doing the same steps as I described earlier, on a new self-hosted docker installation on version 4.5.1
https://imgur.com/lr9Sz6k


The issue I’m experiencing appears to be the same as the following posted on GitHub, but instead of campaigns it’s for layouts:


On top of that, granting “Full Access” in the user’s folder permission tab, does not appear to save the checkmarks.
https://imgur.com/jPd3cI4

Updated to version 4.5.2. The problem is solved