Skip to content

fix: check perms before installing library during restore#81

Merged
rhell4 merged 1 commit intostable-catalystfrom
restore-library-perms
Feb 11, 2026
Merged

fix: check perms before installing library during restore#81
rhell4 merged 1 commit intostable-catalystfrom
restore-library-perms

Conversation

@rhell4
Copy link

@rhell4 rhell4 commented Feb 11, 2026

Problem:
Perms are not checked when a user tries to restore a H5P activity with a library that is not installed on the site. This means users could bypass the permissions by backing up the activity in a different site with the library and then restoring it into another site without the library.

Solution:
Ideally it would be nice to just skip the activity and leave a message for the user doing the restore. Unfortunately doing this at a point we can is too late, leading to issues with restoring contexts, sections, files, etc. due to the activity being now missing. Alternative is to restore the activity but not the library, meaning when going to the activity it will error due to the library being missing, this may be confusing to the user and may be missed by the user if they do not check.

The most simplest way is to throw an exception with the exact reason why the restore is not possible. The user can then exclude that activity, ask the required people to install that library, etc.

The logic with the is_recommended stuff is taken from here: https://github.com/h5p/h5p-editor-php-library/blob/80b3b281ee9d064b563f242e8ee7a0026b5bf205/h5peditor.class.php#L526

Testing:

  • Have two sites, one with a library installed, and another without that library
  • Go to the site with the library installed
  • Create a H5P activity using that library
  • Backup that activity
  • Go to the site without that library installed
  • Be logged in as a user you can restore the activity but does not have the capability to install new content types
  • Try to restore the backup
  • Expected outcome is for the restore to error stating "You do not have permission to install missing content type xyz. Contact the administrator of your site."

Copy link

@keevan keevan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some re-wording suggestions. Overall changes are sound and make sense.

Thanks Rossco

@rhell4 rhell4 force-pushed the restore-library-perms branch from 376047e to 38f7c94 Compare February 11, 2026 05:03
@rhell4 rhell4 merged commit 4ba2e44 into stable-catalyst Feb 11, 2026
11 checks passed
@rhell4 rhell4 deleted the restore-library-perms branch February 11, 2026 05:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants