[5.4] check ACL when display link to user edit form

[heelc29]

Pull Request for Issue from @chmst #pbf26

Summary of Changes

Checks the ACL (Access Control List) to decide whether to display a link or just the name.

Testing Instructions

• login as an user who belongs to Manager group
• view article or contact list and click on an user (which is not a super user) and click on it

• then login as superuser and change permission of user component for manager group; allow: Access Administration Interface and deny: Edit

• login as an user who belongs to manager group again and click link again

Actual result BEFORE applying this Pull Request

1st try

2nd try

Expected result AFTER applying this Pull Request

name of user is only displayed - no link anymore

Link to documentations

Please select:

• No documentation changes for docs.joomla.org needed
• No documentation changes for manual.joomla.org needed

[exlemor]

I have tested this item ✅ successfully on 67d7f2b

I have tested this successfully - thank you @heelc29!

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.}

[ChristineWk]

I have tested this item ✅ successfully on 67d7f2b

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.}

[krishnagandhicode]

I have tested this item ✅ successfully on 67d7f2b

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.}

[richard67]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.}

[muhme]

❌ Final test before merge with JBT

• Installed Blog Sample Data, Created manager, editor, to-be-deleted users, Created 3 contacts with linked users, created articles as users manager, editor, to-be-deleted, deleted the to-be-deleted user entry
• Seen 403 before in articles view and contacts and with user component permissions Edit Denied
• Applied PR with Patch Tester
• ✅ Articles/Contacts as Super User all Authors/Linked User entries are still linked names and the links are working
• ✅ '[ None ]' is still displayed for deleted user entry
• ✅ Articles/Contacts as manager other Authors/Linked User entries are only names and no more links
• ❌ Articles/Contacts as manager: The user's own entry is no longer linked; previously, the user's own entry was linked and opening the user entry worked in Articles/Contacts
• Changed user component permissions Edit Denied
  • ✅ Articles/Contacts as manager all Authors/Linked User entries are only names and no more linked

[muhme]

@heelc29 Thank you for your contribution. In final testing I found with user component permissions edit enables, the user's own entry is no longer linked. Before the PR, the user's own entry was linked and opening the user entry worked in Articles and Contacts. Could you please check?

[heelc29]

@heelc29 Thank you for your contribution. In final testing I found with user component permissions edit enables, the user's own entry is no longer linked. Before the PR, the user's own entry was linked and opening the user entry worked in Articles and Contacts. Could you please check?

Yes, you're right. There's an exception for this in the com_user dispatcher. I will update the check.

joomla-cms/administrator/components/com_users/src/Dispatcher/Dispatcher.php

Lines 40 to 48 in 3fad048

	// Allow users to edit their own account
	if (\in_array($task, $allowedTasks, true) || ($view === 'user' && $layout === 'edit')) {
	$user = $this->app->getIdentity();
	$id = $this->input->getInt('id');
	if ((int) $user->id === $id) {
	return;
	}
	}

[joomdonation]

I remember that although the field has int data type, the data returns from database for the field could be int or string, depends on database system. So to be safe, I think you should use == instead of === operator here.

[richard67]

Back to pending as changes have been requested.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46805.}