"Manage publish state" permission not working

[steveooo1]

I created a test user with a role that disallows managing publish states. E.g. for authors that only are able to create stuff, but not publish it before a proofreader approves this. I unchecked the "Manage publish state" option but still, I am able as the user to publish entries.

The resources/users/roles.yaml:

author:
  title: Author
  permissions:
    - 'access cp'
    - 'view test entries'
    - 'edit test entries'
    - 'create test entries'

[goellner]

I just set up the exact same thing, since I will need it for a project. I can confirm, that the user can manage the publish state, which he shouldn't.

[taoguangc]

Yes I have this problem too! And at the page list can sort pages.

[steveooo1]

I hope this gets fixed in a future release!

[jasonvarga]

It cannot be fixed in a previous release!

[steveooo1]

Therefore it must be fixed in a future release…or the current.

[steveooo1]

Wanna fight?! 4pm in the backjard of your school. 1 vs 1.

[steveooo1]

I bring my bike crib gang..

[tao]

The same bug seems to apply to creating/publishing revisions, and deleting entries.

[tbruckmaier]

The logic seems to work when revisions are enabled, though there are some UX issues: the user without the publish permission sees the "publish" button, but a click on it returns "error: request failed with status 403" and the entry is (correctly) not published. The user with publish rights can publish afterwards.

Also the revision's author is changed to the publishing user, I'm not sure if that is intended?

And another thing: if the non-publishing user saves a revision, he can no longer edit anything, as the form is displayed as readonly. Only if his changes are published, he can create a new revision. Or am I using this wrong? Nope that was just a problem with my custom permissions, works fine!

To sum it up, the publish feature with the permissions works fine if revisions are enabled (just the publish button is displayed when it shouldnt). So maybe just the docs have to be updated?

[duncanmcclean]

I've created a pull request which will set the published toggle to be read only if a user doesn't have the correct set of permissions. #3039