Staff can see custom navigation menu group editor

AI-generated summary

Lilly started a discussion about a permissions issue where non-admin staff could view and attempt to edit custom global menu sections, would receive a permissions error on saving changes. Only admin should be able to edit these sections.

Canapin confirmed the behavior, noting that staff could even initially create a custom global section, though saving changes results in permission errors.

Lilly thanked Canapin for pointing out staff could create sections, as she had not tested that, and said she would update the original post.

Ted responded thanking Lilly for the detailed report, and confirmed it was a UI issue not reflecting that moderators cannot edit public categories. Ted linked to a pull request that implements a fix: post 6.

Lilly thanked Ted for the quick response and fix.

It appears that all staff seem to have access to the editor for custom global menu sections, although if anyone but admin tries to save changes, a permission error is generated. Only admins should be able to see the pencil editor buttons and access the custom menu sections modals (not all staff). Also, only admins should see the globe icon that indicates a public menu section. Mods can see both the globe and pencil icons.

Repro: (first two screenshots in safe mode)

  1. Make a custom global menu section with admin account (or with a moderator staff account!)
  2. Log in with a Moderator account and see globe and pencil icons in global menu section

  1. Try to edit the custom section and make a change and click save button.

Permissions settings for moderator (non-admin staff) used in screenshots above.

5 Likes

The first step can also be “create a new custom section with a staff, non-admin account”. The behavior is the same.

I can repro the issue. The checkbox shouldn’t appear is we don’t have the right to change a section globally. :slight_smile:

4 Likes

oh I didn’t even try that part doh! Thanks for pointing that out. I will add to OP.

2 Likes

Thanks for the report @Lilly! The UI did indeed not reflect the fact that a moderator cannot create, edit, or delete a public category. This has been solved in the fix below:

https://github.com/discourse/discourse/pull/23683

8 Likes

Nice work @ted! thanks for the response and fix :slight_smile:

4 Likes