2.5.4 requires view_template permission for listing templates, triggers permission denied popup ("200 OK error")

[funkyduke]

Summary

When logging in as a user with permissions the famous 200 OK error is back after upgrade to 2.5.4. (https://forums.modx.com/thread/?thread=92206)

Solution

The solution I found was to check the permission 'view_template'

Step to reproduce

Set permissions to a user and log in. Admins with all rights have no problem.

Observed behavior

You get the 200 OK error

Expected behavior

No 200 OK error

Environment

Modx 2.5.4. / PHP 5.5 or higher

[Mark-H]

If the user doesn't have permission to view templates, they will get an error they don't have permission to access a template when for example listing templates. While the error is not very descriptive, this does not seem like a bug?

[jaygilmore]

If it returns a mystery error message it's a UX bug. If it's showing that old dialogue with 200 and the okay button, that's not just obtuse it gives the impression of something being broken or that the user may have done something wrong.

It should have error state microcopy associated with it. Whenever someone attempts to access something they are not permitted to access. Something like "You do not have permissions to access this [OBJECTNAME], please contact your site administrator"

[funkyduke]

In previous versions of Modx (< 2.5.4) there were no problems. After upgrading to 2.5.4. the error 200 OK message is back when the user is going to a resource to update. See the forum for more info about this error, many had this problem in the past, I also. When checking 'view_template' the error is gone. To me that seems like a bug.

[jaygilmore]

Are you suggesting that the Admin or SUDO user doesn't have View Template access by default or is this after creating a new user with a specific set of user permissions?

[Mark-H]

It sounds more like you restricted the user account in the past, but never logged out and back in to update the permissions cached in the session. Then along comes 2.5.4, which wipes the session table, and now a simple configuration issue is a bug in a new version? :P

Improving the error message is tracked in #12568.

[funkyduke]

For the Admin or SUDO everything is fine. It's after creating a new user who has a set of user permissions. Or in the case of Modx 2.5.4. after upgrading to 2.5.4. the existing user permissions of that policy.

[jaygilmore]

Right, @Mark-H, and thanks for sharing the error message task. @funkyduke, I think we need to understand the nature of the user in question for sure.

[jaygilmore]

I'd say if we fail to give users the appropriate permissions, only the error message is the problem, then. The proper message would lead you, the site builder, to be able to associate the problem with the lack of permission on the user account. I am not sure if this is a bug either at this point.

[funkyduke]

I have updated more than 50 sites to 2.5.4 and all of them have the error-message. I am now logging in one by one to check view_template. I don't know how to fix this in another way.

[Mark-H]

Sorry if I'm being too dismissive of this issue @funkyduke, I'll gladly be proven wrong that this is an actual bug in 2.5.4, but it just sounds like "I didn't give my user the right permission and they got a pop-up telling them they didn't have the right permission".

If you can provide further information that this is an actual bug, and not just a configuration issue you've copy/pasted into those 50 sites, that would be most welcome.

[jaygilmore]

What version of MODX are the sites needing upgrade on currently @funkyduke?

[funkyduke]

@Mark-H I know it's a very annoying issue, but like you can see in the forum many had this problem in the past. And I also had this problem in the past and then we had to give certain permission not to have this error and everything did go fine until now this upgrade to 2.5.4. Most of my sites were on 2.5.2 before upgrade, some had an earlier version (but never very old). So if the user shouldn't have the right permissions, why did it work in the past without 'error 200 OK'-message, and now with the upgrade the error is back? On all of my websites? When upgrading nobody was logged in and I cleared the cache before upgrade.

[funkyduke]

for info: If you click away the error you can normally update the resource.

[jaygilmore]

@Mark-H any chance #13174 could have affected this? I don't have any clue, though. There really aren't that many changes between 2.5.2 and 2.5.4 so I am a little unsure of why this would show up.

[funkyduke]

The full message is this:

Code: 200 OK {"success":false,"message":"Toegang geweigerd!","total":0,"data":[],"object":[]}