{"action":"opened","issue":{"url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6043","labels_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6043/labels{/name}","comments_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6043/comments","events_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6043/events","html_url":"https://github.com/OrchardCMS/Orchard/issues/6043","id":117347056,"number":6043,"title":"Error with listable content when the user does not have the EditContent permission","user":{"login":"DanielLackenbyBede","id":3942432,"avatar_url":"https://avatars.githubusercontent.com/u/3942432?v=3","gravatar_id":"","url":"https://api.github.com/users/DanielLackenbyBede","html_url":"https://github.com/DanielLackenbyBede","followers_url":"https://api.github.com/users/DanielLackenbyBede/followers","following_url":"https://api.github.com/users/DanielLackenbyBede/following{/other_user}","gists_url":"https://api.github.com/users/DanielLackenbyBede/gists{/gist_id}","starred_url":"https://api.github.com/users/DanielLackenbyBede/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanielLackenbyBede/subscriptions","organizations_url":"https://api.github.com/users/DanielLackenbyBede/orgs","repos_url":"https://api.github.com/users/DanielLackenbyBede/repos","events_url":"https://api.github.com/users/DanielLackenbyBede/events{/privacy}","received_events_url":"https://api.github.com/users/DanielLackenbyBede/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-17T12:38:18Z","updated_at":"2015-11-17T12:38:18Z","closed_at":null,"body":"Straight down to brass tacks:\r\nOrchard.Core.Contents.Controllers.AdminController [ln:83](https://github.com/OrchardCMS/Orchard/blob/dev/src/Orchard.Web/Core/Contents/Controllers/AdminController.cs#L83)\r\n\r\n    var query = _contentManager.Query(versionOptions, GetListableTypes(false).Select(ctd => ctd.Name).ToArray());\r\n\r\nThis makes a call to the method _GetListableTypes()_ which is as follows:\r\nOrchard.Core.Contents.Controllers.AdminController [ln:150](https://github.com/OrchardCMS/Orchard/blob/dev/src/Orchard.Web/Core/Contents/Controllers/AdminController.cs#L150)\r\n\r\n        private IEnumerable<ContentTypeDefinition> GetListableTypes(bool andContainable) {\r\n            return _contentDefinitionManager.ListTypeDefinitions().Where(ctd =>\r\n                Services.Authorizer.Authorize(Permissions.EditContent, _contentManager.New(ctd.Name)) &&\r\n                ctd.Settings.GetModel<ContentTypeSettings>().Listable &&\r\n                (!andContainable || ctd.Parts.Any(p => p.PartDefinition.Name == \"ContainablePart\")));\r\n        }\r\n\r\nNow, when the user authorizes against *Permissions.EditContent* then the check goes on to check whether the Content Type is Listable and the whether the Containable condition checks out. This will successfully return a list of all the types that the user should see. If the user does not authorize against *Permissions.EditContent* then _GetListableTypes(false).Select(ctd => ctd.Name).ToArray()_ will return an empty array. So far so good.\r\n\r\nNow, that array of string is passed into _\\_contentManager.Query(...)_ and eventually comes down to:\r\nOrchard.ContentManager.DefaultContentQuery [ln:94](https://github.com/OrchardCMS/Orchard/blob/dev/src/Orchard/ContentManagement/DefaultContentQuery.cs#L94)\r\n\r\n       private void ForType(params string[] contentTypeNames) {\r\n            if (contentTypeNames != null && contentTypeNames.Length != 0) {\r\n                var contentTypeIds = contentTypeNames.Select(GetContentTypeRecordId).ToArray();\r\n                // don't use the IN operator if not needed for performance reasons\r\n                if (contentTypeNames.Length == 1) {\r\n                    BindItemCriteria().Add(Restrictions.Eq(\"ContentType.Id\", contentTypeIds[0]));\r\n                }\r\n                else {\r\n                    BindItemCriteria().Add(Restrictions.InG(\"ContentType.Id\", contentTypeIds));\r\n                }\r\n            }\r\n        }\r\n\r\nWhere the result of _GetListableTypes(false).Select(ctd => ctd.Name).ToArray()_ is passed through as *contentTypeNames*.\r\nThe check that *contentTypeNamed.Length != 0* means that when the user cannot see any content types: instead of all items being filtered out, no filtering occurs so the user sees all content: including those that are not set as Listable (which from experience is a lot of extra content)."}}