UVE: Layout Editor Publishes Page On Change

[ian-b-cooper]

Parent Issue

No response

Problem Statement

As a limited user without publish permissions who can edit page layouts, I should not be able to publish pages. However, when I go into edit mode, add published content to the page, then change the page layout, the page gets published with the new layout and content that was previously added.

Steps to Reproduce

1. Create a limited user with all edit, but no publish, permissions
2. Login as that user and go to any page within edit mode
3. Add a new piece of published content to the page
4. Go to the layout editor and change the layout of the container the content was added to
5. Open the published version of the page and see that page was published with the new content added by the limited user.

Please see the screencast here

Acceptance Criteria

Users who have edit only permissions should not be able to publish additions to pages, including through altering page layouts.

dotCMS Version

Current/Demo

Proposed Objective

User Experience

Proposed Priority

Priority 2 - Important

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

As reported by a customer

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response

[fmontes]

We do a request like this

curl 'http://localhost:8080/api/v1/page/{pageId}/layout?variantName=DEFAULT' \
  -H 'Accept: */*' \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://localhost:8080' \
  -H 'Referer: http://localhost:8080/dotAdmin/' \
  --data-raw '{
    "themeId": "{themeId}",
    "layout": {
      "width": "",
      "title": "anonymouslayout1600437132653",
      "header": true,
      "footer": true,
      "body": {
        "rows": [
          {
            "columns": [
              {
                "containers": [
                  {
                    "identifier": "//demo.dotcms.com/application/containers/banner/",
                    "uuid": "1"
                  }
                ],
                "leftOffset": 1,
                "width": 11,
                "styleClass": "banner-tall"
              }
            ],
            "styleClass": "p-0 banner-tall"
          }
          // Additional rows removed for brevity
        ]
      },
      "version": 1
    }
  }'

Why this is publishing the page if we are hitting layout? @nollymar I think we need to start our research in the backend.

[jgambarios]

After conducting some research, I found that calling layouts does not publish anything on the page. Instead, it simply clears the cache, reflecting the changes made by the user. In fact, you can observe the same behavior when a limited user adds content and the cache is flushed from an admin account.

Regarding the cache issue where you add content, and it is not visible on the live preview (which I am currently addressing), I believe this behavior is expected. Specifically, when a limited user adds a piece of published content to the page, it does not count as publishing. Both the page and the content are already published; the user is merely updating the page’s content. In my understanding, this is the intended behavior.

[github-actions]

PRs:

• Fix (Core): Invalidate velocity live version of the page on page changes #31094

[jgambarios]

Note to QA: The content may take a few seconds to appear on the live version of the page, depending on the Cache TTL settings. For testing purposes, the Cache TTL can be set to 0.