Users without edit permissions can be set as editors for a page

[abea]

In the Permissions tab of a page, when you use the "These Users can Edit" field to add editors for the page, you have the option to add any user. That includes users who only have guest permissions. Only users with the ability to edit a page/piece should be available to add as editors.

[itsaalexk]

Can you provide more info on this? do you mean on the main page? If you provide a image to know what you mean exactly

[BoDonkey]

Hey @itsaalexk - This is for an older version of Apostrophe. You would have to spin up an Apostrophe 2 project. This can be done with the CLI tools apos create my-project-name --a2. I'll try to spin a project up later and add a screenshot. I'm not even sure it is still an issue.

[BoDonkey]

So the issue is still there. This is the interface that you get when creating a new page in an A2 boilerplate project created with the CLI tool. On the left-hand side, there are two tabs. One is the permissions tab. Clicking on this opens settings for user and groups permissions. In this case I've added two users. "Mary Jones" is an admin. She should be able to edit the page. "Bill Madison" was added as a guest. This account should not be selectable from the user permissions dialog. I should note, even though this account can be added into the user permissions group to be able to edit, this correctly is not honored if the person tries to log-in and edit the page. So this is only a problem with the population of the user permissions field for the page.