-
Bug
-
Resolution: Fixed
-
Low
-
2.7.1
-
None
The Space Permissions user interface contains an "Anonymous -> News -> Remove" permission. This permission can be successfully turned on (unlike the Anonymous -> Pages -> Restrictions" permissions. When this is turned on, Anonymous users gain the ability to click the "Remove" button when editing a blog post.
However, the RemovePageAction contains specific logic to deny the effort to remove blog posts. The user is taken to the login page instead (with no error message saying why).
Given that "removing" a blog post actually just sends it to trash, there doesn't seem to be any great harm in allowing anonymous users to be permitted to remove blog posts. (I'm not saying I'd recommend it as a good permission to enable on a public site, just that there's nothing particularly insane about allowing the permission to work correctly.