Unwanted permissions to admin panelizer to user role [#2808795]

Hello. I have updated to panopoly 1.40 and panelizer 3.4. (PHP7, Ubuntu 16.04)

One of my user roles ("editor") has unwanted access to the "Customize display" tab in every node and user page. Clicking on panelizer links is perfectly working and editors can change panelizer settings.

I checked the permissions for panelizer module, but only the administrators have them checked.

Other user roles (such as "authenticated" or others) correctly don't see the tab, and don't have access to the related pages even posting the urls directly.

I think another permission triggers the panelizer abilities for editor role. What can it be?

Thank you very much

Comments

Comment #1

29 September 2016 at 16:36

miromarchi created an issue. See original summary.

Comment #2

miromarchi CreditAttribution: miromarchi as a volunteer commented 29 September 2016 at 16:40

Related issues:

+#2799035: Wrong contextual links

Added a partially related issue

Comment #3

miromarchi CreditAttribution: miromarchi as a volunteer commented 3 October 2016 at 07:14

Issue summary:

View changes

minor typo

Comment #4

miromarchi CreditAttribution: miromarchi as a volunteer commented 3 October 2016 at 08:01

I have done some testing switching on and off permissions that I thought might interfere with panelizer ones.

## Nodes
It turned out that Organic Groups "Administer Organic groups permissions" permission triggers the panelizer permissions on nodes.

In my setup I need my editors to be able to administer all groups. But I don't want to let them administer display settings, at least not all display settings for the groups. As I read the panelizer permissions, they should allow me to fine control what each role can or can't edit, panelizer-wise, so I believe this there is a bug here.

## Users
I still can't figure out what keeps my editor users to see a working "Customize display" tab on their own profile. They see the tab button only on their own profile page, but from there they can admin panelizer settings for the user bundle.

Comment #5

miromarchi CreditAttribution: miromarchi as a volunteer commented 3 October 2016 at 18:57

Category:

Support request

» Bug report

change category to bug report

Comment #6

shelane

English

CreditAttribution: shelane commented 12 October 2016 at 15:53

I confirm the same issue with a role having "Administer Organic groups permissions" then they see all options for panelizer even when those panelizer permissions are not set for that role.

Comment #7

DamienMcKenna

NH, USA

CreditAttribution: DamienMcKenna at Mediacurrent commented 14 October 2016 at 02:21

Which version of OG are you using? Are you using any other modules along with it to improve the OG-Panelizer integration?

Comment #8

shelane

English

CreditAttribution: shelane commented 15 October 2016 at 17:33

I'm using OG 2.9 and non else for OG-panelizer (I never looked for any).

We do also use workbench, workbench moderation, workbench OG, and OG access (if any of that is relevant).

Comment #9

miromarchi CreditAttribution: miromarchi as a volunteer commented 19 October 2016 at 08:27

Hi, I'm using OG 7.x-2.9 too. Nothing more related to panelizer or OG.
I also have administerusersbyrole 7.x-2.0, but I don't think it interferes with panelizer permissions.