WIP: Element panel shortcuts expose style groups to roles with “Access content” only (2.4.3)

Bugs
1

Bricks version: 2.4.3

Description
The element panel shortcut bar shows the style groups (Layout, Typography, Background, Border, Gradient, Shape dividers, Transform, CSS, Attributes) to users who have the permission “Access content (HTML) settings” but not “Access style (CSS) settings”. Users can open these groups and edit settings they shouldn’t have access to.

Steps to reproduce

  1. Bricks → Settings → Builder access: create a custom capability with access_element_content enabled and access_element_styles disabled.
  2. Assign it to the Editor role.
  3. Log in as Editor, open a page in the builder, select an element.
  4. Use the shortcut bar on the left side of the element panel → e.g. Transform or Attributes is accessible and editable.

Expected
Only the Content shortcut is shown. Style group shortcuts require access_element_styles.

Actual
All style group shortcuts are shown.

Cause (assets/js/main.min.js, computed shortcuts)
The style groups are pushed under the check for access_element_content. It should be access_element_styles:

this.$_userHasPermission("access_element_content") && (
n.push({ group: "_layout", ... }),
...
n.push({ group: "_attributes", ... })
)

Related
These permissions seem to be enforced only in the builder UI. When saving, I couldn’t find a server-side check for access_element_styles in includes/ajax.php, so any style change made through this gap is saved to the database.

3

@timmse @Matej Can you confirm this? I would like to hand out a website to a customer but won’t do so as long as this hasn’t been fixed.

5

Thanks for reporting this. We’ve confirmed that the quick access bar exposes style groups to users with content-only access. We’ll update this thread once it’s fixed.