Description

'Load' action should be disabled in 'More Actions:' if user has no 'write' permission on a page.

Steps to reproduce

• Log out from a wiki, where acls are enabled. You have no write permission but 'Load' link is available on More Actions menu. When you try to use this action you will get a message about lack of permissions.

Workaround

• Add this to init.py after line 1089 data['title'] = _(title) in 'theme' directory (or redefine actionsMenu function if you have a customized theme)

 1  if action == 'Load' and not request.user.may.write(page.page_name):
 2  data['action'] = 'show'
 3  data['disabled'] = disabled

• before options.append(option % data)

Discussion

Hmm, a user can enter a different name than the one he is reading for action Load. So disabling it because of rights of the current page is not the best solution. Also a user could enter a name where he has no rights to Load to.

• Anyway, it's better than showing to user that he is allowed to do something, while he's not. For now i'm patching my moinmoin installation (Ubuntu, /usr/share/...).

  • He always can enter a pagename he has write access too on any page. Also he can add ?action=Load to any url. I don'T think the behaviour you described is a bug, It is rather a feature,

Plan

• Priority:
• Assigned to:
• Status:

CategoryMoinMoinBug