[4.x]: Unable to edit content Authored by an Admin user

[wolispace]

What happened?

Description

Previously, non-admin users could see Admin users as Authors of entries, and have the ability edit the content. They could also remove them and add themselves.

I see several code changes recently re user permissions so assume this is a normal tightening up of security.

The problem is, any content Authored by an Admin can no longer be maintained by non-admins, and our current workflow relies on this.

Can we have a way of enabling non-admin users to save entries Authored by Admin users?

Steps to reproduce

1. Author an entry as an Admin user
2. See the Admin user as the Author
3. Login as a non-admin user a(with full editing of sections) and view the same entry
4. Author shows as Blank with no way to set yourself (Unspecified server error shows!)
5. Lower the permissions of the Admin author to a content author and anyone can now save changes and crucially SEE the Author not just a blank

Expected behavior

Anyone who is a content author and can view and edit anyones entries can view and edit Admin users entries as well.

Actual behavior

Only Admin users can edit other Admin users content.

Craft CMS version

4.18.5

PHP version

8.2.31

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[linear-code]

CMS-2322

[brandonkelly]

4. Author shows as Blank with no way to set yourself (Unspecified server error shows!)

I’m not able to reproduce that, and there’s nothing in the code that would prevent the selected author from being shown within the field.

cms/src/elements/Entry.php

Lines 1768 to 1785 in 2714b8f

	$fields[] = (function() use ($static, $section, $user) {
	$author = $this->getAuthor();
	return Cp::elementSelectFieldHtml([
	'status' => $this->getAttributeStatus('authorId'),
	'label' => Craft::t('app', 'Author'),
	'id' => 'authorId',
	'name' => 'authorId',
	'elementType' => User::class,
	'selectionLabel' => Craft::t('app', 'Choose'),
	'criteria' => [
	'can' => "viewEntries:$section->uid",
	],
	'single' => true,
	'elements' => $author ? [$author] : null,
	'disabled' => $static || !$this->canChangeAuthor($user),
	'errors' => $this->getErrors('authorId'),
	]);
	})();

Perhaps a plugin or module is interfering in some way. Try enabling safeMode and see if the issue persists.

[wolispace]

Its the Hide Admin plugin:
https://github.com/jalendport/craft-hideadmin/blob/master/README.md

---

With CRAFT_SAFE_MODE=true in my .env, I see the Admin author:

Toggle Safe mode off and refresh the entry and we get the blank Author:

I then manually Disabled each plugin (and we have quite a few) to find the culprit.

Thanks for the guidance.

Unless this highlights an issue that plugins should not be able to cause, feel free to close this.

[brandonkelly]

Glad you narrowed it down. I’m not familiar with the plugin but you might want to try reporting the behavior on its repo.