Workaround for a Kirby permissions bug

Kirby 2 Solved ✅
1

Hiya,

I’m running into an issue similar to what’s going on in this thread, where I have a user role that I want to give very specific permissions to.

The permissions themselves are working out great, but even though it’s acting as expected, it’s still throwing out an error saying it didn’t work.

Below, here’s the code I have, in site/roles/bingo.php…

return [
 'name'        => 'Bingo',
 'permissions' => [
   'panel.page.update' => false,
   'panel.page.create' => false,
   'panel.page.delete' => false,
   'panel.page.url' => false,
   'panel.page.visibility' => false,
   'panel.page.read' => function() {
     $check = false;
     if($this->target()->page()->slug() === 'gaming'){
       $check = true;
     } else if($this->target()->page()->slug() === 'bingo') {
       $check = true;
     }
     return $check;
   },
   'panel.page.update' => function() {
     $check = false;
     if($this->target()->page()->slug() === 'bingo'){
       $check = true;
     }
     return $check;
   },
   //'panel.file.update' => false,
   //'panel.file.replace' => false,
   'panel.file.delete' => false,
   'panel.file.upload' => function() {
     return $this->target()->page()->slug() === 'bingo';
   }
 ]
];

What I’m trying to do here is allow the user to only view/edit the page called bingo (and since bingo is located inside gaming, I’m allowing the user to see gaming as well)

As I said, this is working great, but when I hit save as a bingo user, I get this dialog…
image

In addition to that, the page is giving me the dirty layout, with Discard & Save.
image

@texnixe siad this was a known bug and opened this GitHub issue, but as this is a site I currently have out in production, I’m hoping there’s a way to deal with this problem now, since that issue was opened up in January?

Thanks.

2

Hm, don’t have a solution, I’m afraid.

Maybe set visibility permission to true? Or genererally disallow toggling of visibility via blueprint? Guess you could also conditionally hide the toggle button via a stylesheet (but don’t know if that’s feasible for the page view).

1 Like
3

Yeah, that did it!

I just changed it to

'panel.page.visibility' => true,

Naturally this means the Bingo user could turn off and on the bingo page if they felt like, but more crucially it means that the user won’t be told the save was unsuccessful, and that’s good enough for this particular case.

Thanks a lot, @texnixe

4

As I said, if the bingo page has it’s own blueprint, you could set the visibility toggle to false:

options:
  status: false

(Then no-one will be able to change the page’s visibility via the Panel, but maybe that is not important)

The error only occurs if the visibility is set to false in the role file (whatever the reason)

1 Like