REST API: Anonymous users cannot create contents with Category fields.

[joseorsini]

Despite that we have a property that bypasses some permissions related to creating contents via REST API

REST_API_CONTENT_ALLOW_FRONT_END_SAVING

once the parent content type has a Category field, it doesn't matter if the actual Category selected on the content to be created has CMS Anonymous -> View permission. Permissions validation would indicate that the Anonymous user does not have permission to view the Category, however it has the required permissions under normal circumstances.

Expected Behavior

In the same way the REST_API_CONTENT_ALLOW_FRONT_END_SAVING property is respected for saving contents after fields' validation, it should be checked once Categories are pulled and then added to the current contentlet object to be saved.

Current Behavior

Even if you set:

• the REST_API_CONTENT_ALLOW_FRONT_END_SAVING property to true.
• Set CMS Anonymous -> Edit permission on the Content Type.
• Set CMS Anonymous -> View on the category and its child ones for the Category field on this same content type.

Contents cannot be created via REST API calls if you're not logged in to the frontend. Now, if you remove this Category field, content gets saved under the same config/settings detailed above.

Possible Solution

Update the ContentResource and honor this property upon lookup of categories, in case the content type has category fields and there were populated upon content submission.

Known Workarounds

None.

Steps to Reproduce (for bugs)

1. Create a Test Content Type, called "Test Cat".
2. Create a Text field, called "Title".
3. Create a Categories field, Called "Event Type". Select "Event Types" for this field once it's being created.
4. Make sure that Event Types category has CMS Anonymous -> View permission.
5. On demo.dotcms.com site, set "CMS Anonymous -> Edit" Permission for Content Types and Contents/Files.
6. run the following curl commands:

Without Category field on JSON sent to the application:

JoseMa-MacBook-Pro:3.7.1-dist joseorsini$ curl -v -XPUT https://demo.dotcms.com/api/content/save/1 -H "Content-Type:application/json" -d '{
>     stName:"TestCat",
>     languageId:1,
>     title:"test content"
> }'
*   Trying 54.165.137.45...
* TCP_NODELAY set
* Connected to demo.dotcms.com (54.165.137.45) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: demo.dotcms.com
* Server certificate: Let's Encrypt Authority X3
* Server certificate: DST Root CA X3
> PUT /api/content/save/1 HTTP/1.1
> Host: demo.dotcms.com
> User-Agent: curl/7.51.0
> Accept: */*
> Content-Type:application/json
> Content-Length: 68
>
* upload completely sent off: 68 out of 68 bytes
< HTTP/1.1 200 OK
< Date: Wed, 19 Jul 2017 18:59:54 GMT
< Content-Length: 0
< Connection: keep-alive
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=964FB8F2055C2439B9A930A50485CE42; Path=/; Secure; HttpOnly
< Location: https://demo.dotcms.com/api/content/inode/e33c5c71-a2a7-49e3-954e-f80e53ab2057
< inode: e33c5c71-a2a7-49e3-954e-f80e53ab2057
< identifier: f4be4e35-c12b-4222-a7ff-1e2a6b27bd8b
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS
< Access-Control-Allow-Headers: Authorization, Accept, Content-Type, Cookies
<
* Curl_http_done: called premature == 0
* Connection #0 to host demo.dotcms.com left intact

With a category field on the JSON sent to the application

JoseMa-MacBook-Pro:3.7.1-dist joseorsini$ curl -v -XPUT https://demo.dotcms.com/api/content/save/1 -H "Content-Type:application/json" -d '{
>     stName:"TestCat",
>     languageId:1,
>     title:"test content",
>     eventType:"seminars"
> }'
*   Trying 54.165.137.45...
* TCP_NODELAY set
* Connected to demo.dotcms.com (54.165.137.45) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: demo.dotcms.com
* Server certificate: Let's Encrypt Authority X3
* Server certificate: DST Root CA X3
> PUT /api/content/save/1 HTTP/1.1
> Host: demo.dotcms.com
> User-Agent: curl/7.51.0
> Accept: */*
> Content-Type:application/json
> Content-Length: 94
>
* upload completely sent off: 94 out of 94 bytes
< HTTP/1.1 403 Forbidden
< Date: Wed, 19 Jul 2017 19:00:20 GMT
< Content-Type: text/plain
< Content-Length: 158
< Connection: keep-alive
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=9C0782D7D46BC3A26996CF5C54C6694E; Path=/; Secure; HttpOnly
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS
< Access-Control-Allow-Headers: Authorization, Accept, Content-Type, Cookies
<
* Curl_http_done: called premature == 0
* Connection #0 to host demo.dotcms.com left intact
User doesn't have permission to save this category = 5193736b-b98c-425d-a12c-0391d2bef6a9 having as parent the category = 5193736b-b98c-425d-a12c-0391d2bef6a9

Context

Reproduced on current 4.1.1 release.
Reported by customer

https://my.dotcms.com/tickets/detail.dot?id=eb4f1f2e-2480-4a0e-ba2b-ec14d28b2a05

Your Environment

• dotCMS 3.6.2, 3.7.1, 4.1.1.
• Any Browser
• Any Operating System.
• Any Application Server.
• Java 8u121.
• Any supported Database.

[joseorsini]

PR: #12151

[DeanGonzalez]

Passed: CMS Anonymous can add content with category as long as the anonymous role has save on the content type.