When editing a Panel page as administrator, i get the message "You are not authorized to access this page" when i try to edit pane settings (e.g. CSS oder settings) or when i try to add new content to panel regions. The error occurs with the role "Administrator". The admin role has all panel related permissions except "Bypass access checks when using Panels In-Place Editor ".

As user 1 there are no problems.

The error does not occur in version 7.x-3.5.

Has anyone experienced the same issue?

Comments

sgoelz created an issue. See original summary.

sgoelz’s picture

sgoelz CreditAttribution: sgoelz commented
Title: Not authorized when managing panes » Not authorized when managing panes as admin
bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
CreditAttribution: bkosborne commented

Can you verify that you've run all the database updates after upgrading to 3.7? There were permissions related issues part of 3.6 release that should have been resolved in the 3.7 release. Please review #2785915: Panels permissions update causes access denied on page manager pages defined in code.

Could you provide as much detail as possible about this problem? Is the panel panel you're editing defined in code or in the database?

aadil.addweb’s picture

aadil.addweb CreditAttribution: aadil.addweb at AddWeb Solution Pvt. Ltd. commented

It's working proper at my side.There are no error while editing panel page and content. I can edit Panel
page as administrator and can also add new content to panel region.

Thanks

couloir007’s picture

couloir007 CreditAttribution: couloir007 commented

I'm having the same issue. User 1 no problem, anyone else, forget it. Panelizer had a similar issue with most recent security update, I wonder if it is related.

https://www.drupal.org/node/2785945#comment-11549859

jmanny’s picture

jmanny CreditAttribution: jmanny commented

You guys have to make sure to Run Pending Updates. This should solve this issue, try it and let us know.

attiks’s picture

attiks CreditAttribution: attiks at Attiks commented

Having the same problems, newly created panel nodes can not be edited using the "Customize this page" button, the button is visible, but if you click on it, you get a javascript alert with an access denied. Editing the content in the backend UI (just saving without changing anything) fixes it.

doostinharrell’s picture

doostinharrell CreditAttribution: doostinharrell commented

@attiks I can also confirm that editing and the panelizer panel via "customize display" and simply saving resolves the IPE issue as well.

Thanks!

aubjr_drupal’s picture

aubjr_drupal CreditAttribution: aubjr_drupal as a volunteer commented

I don't recommend using the "Customize Display" tab as a workaround if you want to keep the broken node/page in sync with the default Panelizer layout for that page.

Instead, https://www.drupal.org/node/2790499#comment-11562991 has the link for the solution:
1) Patch Panelizer with (they should both get into 7.x-3.5):
a) https://www.drupal.org/node/2785945#comment-11549859
b) http://cgit.drupalcode.org/panelizer/commit/?id=b15972aae9ed9dfc7d3977a4...
2) Run update.php (reapplies database updates). This will reapply the DB updates and should fix your issue.

There was more to do in my case; I had an individual node/page (Ex. /user/12345) that still wasn't resetting properly after the patch. Looking around, I found a dupe record in panels_display that broke the access of that page. Solution (in the following database tables):

  1. panels_display - There were two entries with storage_id = user:user:default but had different storage_type values: "panelizer_default", "panelizer_entity" (I deleted the latter)).
  2. panelizer_defaults (Updated display ID (did) to match correct remaining record in panels_display after deleting the dupe in step a).
  3. panelizer_entity (Had a single entry from a past "customize this page" that had to be manually deleted via SQL).

In short, use the patch. If the patch doesn't work, be prepared for a little SQL surgery to fix individual, edge cases.

Juanpgs’s picture

Juanpgs CreditAttribution: Juanpgs commented

following the aubjr_drupal solution, I just checked the panelizer_defaults table and I realised that there were two entries for the same content type, node:article:default and node:article:default:full.
My settings were set up to use the last one so I removed the first one and the problem solved.