{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/6113","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/6113/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/6113/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/6113/events","html_url":"https://github.com/joomla/joomla-cms/pull/6113","id":57976848,"number":6113,"title":"Front-end module editing is blocked if you do not have component level permission","user":{"login":"mbabker","id":368545,"avatar_url":"https://avatars.githubusercontent.com/u/368545?v=3","gravatar_id":"","url":"https://api.github.com/users/mbabker","html_url":"https://github.com/mbabker","followers_url":"https://api.github.com/users/mbabker/followers","following_url":"https://api.github.com/users/mbabker/following{/other_user}","gists_url":"https://api.github.com/users/mbabker/gists{/gist_id}","starred_url":"https://api.github.com/users/mbabker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbabker/subscriptions","organizations_url":"https://api.github.com/users/mbabker/orgs","repos_url":"https://api.github.com/users/mbabker/repos","events_url":"https://api.github.com/users/mbabker/events{/privacy}","received_events_url":"https://api.github.com/users/mbabker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/PR-staging","name":"PR-staging","color":"c7def8"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-02-17T20:24:44Z","updated_at":"2015-02-18T09:38:42Z","closed_at":"2015-02-17T21:32:34Z","pull_request":{"url":"https://api.github.com/repos/joomla/joomla-cms/pulls/6113","html_url":"https://github.com/joomla/joomla-cms/pull/6113","diff_url":"https://github.com/joomla/joomla-cms/pull/6113.diff","patch_url":"https://github.com/joomla/joomla-cms/pull/6113.patch"},"body":"If a usergroup does not have component level frontend module editing permission but does have module level permission, a user should be able to edit the single module(s) they have permissions to.  However, due to a bad ACL check, the user is given a \"You are not authorized to access this resource\" message when attempting to edit or save a module.  The failure is caused by a check if either condition is false, whereas the check should be if both conditions are false.  Corrected in PR.\r\n\r\n### Testing Instructions\r\n\r\nModified test instructions from what I wrote in #5397 as doing that is how I found the bug.\r\n\r\n1) Create a new group and set the Group Parent as Public\r\n2) In the Global Configuration give this group \"Site Login\" permission. Do not change any other values.\r\n3) In the module(s) you want this group to be able to edit, give them \"Frontend Editing\" permission.\r\n4) Ensure your group is in at least the \"Registered\" Viewing Access Level.\r\n5) Create a user and assign them to this group.\r\n6) Try to edit the module(s) the group has access to in the frontend, you should get the error.\r\n7) Patch and try again, ensure your changes get saved."},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/74836620","html_url":"https://github.com/joomla/joomla-cms/pull/6113#issuecomment-74836620","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/6113","id":74836620,"user":{"login":"Bakual","id":1018684,"avatar_url":"https://avatars.githubusercontent.com/u/1018684?v=3","gravatar_id":"","url":"https://api.github.com/users/Bakual","html_url":"https://github.com/Bakual","followers_url":"https://api.github.com/users/Bakual/followers","following_url":"https://api.github.com/users/Bakual/following{/other_user}","gists_url":"https://api.github.com/users/Bakual/gists{/gist_id}","starred_url":"https://api.github.com/users/Bakual/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bakual/subscriptions","organizations_url":"https://api.github.com/users/Bakual/orgs","repos_url":"https://api.github.com/users/Bakual/repos","events_url":"https://api.github.com/users/Bakual/events{/privacy}","received_events_url":"https://api.github.com/users/Bakual/received_events","type":"User","site_admin":false},"created_at":"2015-02-18T09:38:42Z","updated_at":"2015-02-18T09:38:42Z","body":"Sounds like something went wrong there then with your installation. It's certainly not related to this patch."}}