As designed Going to admin group without permission loads page...

[Liam W]

Didn't know how to explain what I mean, and still don't...

Basically, if you don't have permission to say, manage users, but you go to admin.php?users, you still get the users page (albeit blank).

This is more obvious with development tools - the entire page loads, with all the page picture links (it just has the home tab selected).

Liam

 

[Chris D]

For the users case this seems to be deliberate. The pre dispatch in the User controller specifically bypasses the permission check for the index. I'm not entirely sure why (I can't see an obvious reason) so we'll have a closer look.

 

[Mike]

This is generally deliberate, though there are tweaks that need to be made.

In most cases, the top level "tab" navigation doesn't directly enforce permissions. It works by hiding the tab if the user doesn't have access to anything within. This allows add-ons to add things that depend on different permissions, for example. If we didn't "allow" access to the index page of the section, you'd click the tab -- despite having access to things in the tab -- and get a no permission action. A blank page isn't necessarily ideal, but I think it's better than a permission error.