Custom block permissions for Administrators group no longer work
Permalink
Up until concrete5 8.5.1 this worked: As "admin" (Super-)User I always see all blocks no matter what permissions are set. But users in the "Administrators" group can only add specific blocks that I allow. This is a great feature, but it no longer works in concrete5 8.5.2 (fresh installation). Users in the "Administrators" group now always see all blocks no matter what I set.
How to reproduce:
- Go to Block & Stack Permissions (/index.php/dashboard/blocks/permissions)
- Go to Details
- Set "Custom" for Administrators
- Only allow a few blocks, disallow all other blocks
- Click "Save"
- Click "Save" again (in the parent screen)
- Create a user, put him in the "Administrators" group
- Login as that user
- Add content to a page
--> sees ALL blocks!
Note: My policy is that users should generally not login using the "admin" user, but always with their own user. However I do not want to create groups and set all those permissions, because that is a lot of work and totally unnecessary, so they get the "Administrators" group. All I need is to disallow blocks for users so they don't accidentally add a concrete5 out-of-the-box block that is completely unstyled and doesn't fit the CI/CD. The "admin" user can of course do whatever he wants.
How to reproduce:
- Go to Block & Stack Permissions (/index.php/dashboard/blocks/permissions)
- Go to Details
- Set "Custom" for Administrators
- Only allow a few blocks, disallow all other blocks
- Click "Save"
- Click "Save" again (in the parent screen)
- Create a user, put him in the "Administrators" group
- Login as that user
- Add content to a page
--> sees ALL blocks!
Note: My policy is that users should generally not login using the "admin" user, but always with their own user. However I do not want to create groups and set all those permissions, because that is a lot of work and totally unnecessary, so they get the "Administrators" group. All I need is to disallow blocks for users so they don't accidentally add a concrete5 out-of-the-box block that is completely unstyled and doesn't fit the CI/CD. The "admin" user can of course do whatever he wants.
I now disabled all the caches and then cleared the cache. Still the same issue :(
Update: It didn't work on my local Windows machine. After uploading the site to a Linux PHP Hosting, the block permissions work. Strange, but that resolves the issue for me.
Try turning off all caches, clear the cache and the browser cache and try again as the new user.
EDIT, this was on an 8.5.2 install.