[Bug] Permission package

[siberfx]

Bug report

What I did

I've seeded permissions and role groups, all configurations is set proper, it hides menu elements.

What I expected to happen

it should hide all menu which is hidden by permission or the role ( backpack_user->hasPermissionTo('project_access') )

What happened

but when it comes to hide sidebar_content elements on dashboard page it hides them, but when it comes to get into a menu item, some hidden items are becoming visible on sidebar.

What I've already tried to fix it

I've checked auth.php, and also base.php, I ensure its not caused by a code override.

Backpack, Laravel, PHP, DB version

When I run php artisan backpack:version the output is:

LARAVEL VERSION:

v8.31.0@2aa5c2488d25178ebc097052c7897a0e463ddc35

BACKPACK VERSION:

4.1.38@90cf9d0613848144c1e5f3822892bf2a7afa860f

[siberfx]

I have found the reason, but it requires your help :)

when we create custom crud operations this bug occures.

[pxpm]

@siberfx thanks for the report.

Could you clarify what you are doing ? I guess that all CRUD operations are custom, like Fetch, Inline or wtv.

You have the auth checks in sidebar_content ? Could you try:

@dd(backpack_user()) when in dashboard and also when in other crud pages ? Does it happen to ANY crud ? Could you share the name of the CRUD where it is not working ?

Best,
Pedro

[siberfx]

if you use this kind of crud-operations, this breaks the permission package's
backpack_user()->can and backpack_user()->hasPermissionTo

and even those items has no permission for the logged in user they are still visible inside the page.
on dashboard, or if I use the default ShowOperation those items are hidden still. when I use like in the image above, those items still visible. no extra logic in it. no changes either. if you need more information I can add more code here
thank you in advence

[pxpm]

Hello @siberfx

I am sorry but I could not reproduce your issue.

What I did:

Copied ShowOperation into CustomShowOperation and added use CustomShowOperation in the controller.

Added to sidebar: backpack_user()->hasPermissionTo('manage news') (User does not have permission for this).

Go into my CustomShowOperation, item still hidden in sidebar.

Might be a cache issue ? Try running php artisan cache:clear, and forcely clear permission cache when updating permissions via WebUI.

Let me know if I missed some step to reproduce it.

Thanks,
Pedro

[siberfx]

well its not a cache issue for sure, I am still investigating deeply to find out, if it's something related to backpack, I'll let you know

[jcastroa87]

Hi.

Due to not activity on many years i will close this discussion, if there is needed feel free to reopen or create a new one.

Cheers.