mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
5cbd2dbeb4
CMSProfileController currently checks canView() which ensures that a logged in CMS Member can access the profile controller, but when saving the record on Member_ProfileForm there is no check for canEdit(), so extended permissions don't get respected. This adds a check for canEdit() in Member_ProfileForm, and adds some functional tests to check permissions.
28 lines
600 B
YAML
28 lines
600 B
YAML
Permission:
|
|
admin:
|
|
Code: ADMIN
|
|
cmsmain:
|
|
Code: CMS_ACCESS_LeftAndMain
|
|
leftandmain:
|
|
Code: CMS_ACCESS_CMSMain
|
|
Group:
|
|
admins:
|
|
Title: Administrators
|
|
Permissions: =>Permission.admin
|
|
cmsusers:
|
|
Title: CMS Users
|
|
Permissions: =>Permission.cmsmain, =>Permission.leftandmain
|
|
Member:
|
|
admin:
|
|
FirstName: Admin
|
|
Email: admin@user.com
|
|
Groups: =>Group.admins
|
|
user1:
|
|
FirstName: Joe
|
|
Email: user1@user.com
|
|
Groups: =>Group.cmsusers
|
|
user2:
|
|
FirstName: Steve
|
|
Email: user2@user.com
|
|
Groups: =>Group.cmsusers
|