U4-10964 - Adding a new property to a MemberType if you are not in Sensitive Data group throws a 404 when saving

Created by Warren Buckley 12 Feb 2018, 11:04:19 Updated by Robert Copilau 23 Feb 2018, 12:35:11

'''Steps to Repro'''

  • Login as a user who does not have access to sensitive data
  • On an existing member type - add a new field/property to the schmea
  • You will get a 404 exception thrown as shown in YSOD

Logic in code is wrong & it should not throw an exception if a user who does not have access is simply adding a new property to the member type https://github.com/umbraco/Umbraco-CMS/blob/dev-v7.9/src/Umbraco.Web/Editors/MemberTypeController.cs#L148

1 Attachments


Sebastiaan Janssen 23 Feb 2018, 12:20:13

PR: https://github.com/umbraco/Umbraco-CMS/pull/2472

We are trying to find each property submitted when a membertype is updated so that we can check if the user is allowed to update the sensitive data flag. Of course new properties can't be found in the database yet so we need to ignore those. New properties have the Id 0 so that's a pretty easy check.

Robert Copilau 23 Feb 2018, 12:35:06

Tested and can add a new field to the member type. Merged.

Priority: Normal

Type: Bug

State: Fixed


Difficulty: Easy


Backwards Compatible: True

Fix Submitted:

Affected versions: 7.9.0

Due in version: 7.9.0

Sprint: Sprint 79

Story Points: 1

Cycle: 8