Skip to content

Conversation

@q8X
Copy link
Contributor

@q8X q8X commented Sep 7, 2025

This PR fixes an issue introduced by multitheftauto/mtasa-blue#4388

quick fix for permissions
@PerikiyoXD
Copy link

This seems to bypass ACL right enforcement.

I'd advocate for proper ACL right handling per group by default on editor_acl.xml

@sacr1ficez
Copy link
Contributor

@q8X as mentioned above, it should rather go into editor_acl.xml, i assume this is everything:

isPlayerAllowedToDoEditorAction(client,"createElement")
isPlayerAllowedToDoEditorAction(client,"createElement")
isPlayerAllowedToDoEditorAction(client,"deleteElement")
isPlayerAllowedToDoEditorAction(client,"deleteOtherElement")
isPlayerAllowedToDoEditorAction(client,"definitions")
isPlayerAllowedToDoEditorAction(client,"mapSettings")
isPlayerAllowedToDoEditorAction(client, "newMap") )
isPlayerAllowedToDoEditorAction(client, "load") )
isPlayerAllowedToDoEditorAction(client, "saveAs") )
isPlayerAllowedToDoEditorAction(client, "save") )
isPlayerAllowedToDoEditorAction(client, "test") )
isPlayerAllowedToDoEditorAction(client,"test")
isPlayerAllowedToDoEditorAction(client,"editElementProperties"))
isPlayerAllowedToDoEditorAction(client,"editOtherElementProperties"))
isPlayerAllowedToDoEditorAction(client,"moveElement"))
isPlayerAllowedToDoEditorAction(client,"moveOtherElement"))

@xLive
Copy link
Member

xLive commented Sep 15, 2025

As far as I know, editor_acl.xml is only used when starting the local server through the map editor button in the main menu. Other than that, it isn’t used, so the permission error will still show up because acl.xml doesn’t have the editor ACL rights. If we want to add them to all groups, we’d need to do that when the editor starts, similar to how admin ACL rights are handled in the admin_ACL.lua.

The current solution in this PR restores the old behavior, where all actions are allowed by default unless explicitly denied.

@sacr1ficez
Copy link
Contributor

sacr1ficez commented Sep 16, 2025

Alright let's merge it for now. And later this could be reverted, once another solution is applied.

@sacr1ficez sacr1ficez merged commit fd196fc into multitheftauto:master Sep 16, 2025
1 check passed
@q8X q8X deleted the permission-fix branch September 17, 2025 00:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants