Category security settings reset when changing parent/subcategory relationship

[Moin]

Steps to reproduce:

1. Enable the upcoming change “Enable simplified category creation”
2. Create a category “Test category”
3. Create a category “Test subcategory”
4. Enable the “advanced settings” and go to the “Security” tab
5. Add a group to the security permissions of the subcategory and remove the reply and create permission from “everyone”
6. Save the changes and refresh to confirm they were applied
7. Go back to the “General” tab and remove the category from the “Subcategory of” setting.
8. Save your changes and check the security settings again

Expected result: The previously configured security settings remain unchanged, as they do when the “Enable simplified category creation” setting is disabled.
Actual result: The security settings are reset without warning, allowing everyone to create and reply to topics again.

Note: The same permission reset occurs when converting a category into a subcategory or when changing its parent category.

[mcwumbly (Dave McClure)]

Thanks for the detailed report.

I had seen something like this before, but thought it was fixed. We’ll take a look.

[awesomerobot (Kris)]

Thanks for reporting it! we ran into this issue on Meta at one point as well.

I’ve just merged an update that will retain the permissions of the category as long as it’s possible… so now the category permissions will only change if the parent category requires it (a more restrictive parent also requires the subcategory to have the same baseline restrictions)

UX: retain permission when changing parent for simplified category creation (#38225)