[BUG]: Frontend Model requires editing permissions in getItem function #1295

New Issue

Closed

opened 2026-03-11 12:07:24 +00:00 by SimonvanDoorne · 9 comments

SimonvanDoorne commented 2026-03-11 12:07:24 +00:00

Member

Copy link

Copy source

What Happened?

When Creating an admin view, and setting the edit/create site view to 'Add+Menu', the resulting model has some editing permission checks that stops non logged in users to access the items.
Screenshot from the model getItem function:

Now if i want to use the helper function from the componenthelper 'getModel' i get an 'not authorised' error for public users

In this case editing access should be required for visibility access

Steps to reproduce the Bug

1. Create admin view
2. Link admin view to component and select Edit/Create Site View => 'Add+Menu'
3. Get the model for admin view
4. Use ->getItem() function while being a non logged in user.
5. Error shown 'Not authorised!'

Which Joomla version are you compiling in?

5.4.3

Which PHP version are you compiling in?

8.1

Which Joomla versions are you targeting?

5.4.3

Which PHP version are you targeting?

8.1

Which Web server is JCB running on?

Ubuntu

Which Relational Database is JCB running on?

MariaDB

Which OS is JCB running on?

Centos

Which JCB version are you using?

5.1.4 stable

Where in JCB did this issue occur?

Compilation of a component

On which browsers did you encounter the issue?

Firefox, Chrome

Additional Comments

No response

### What Happened? When Creating an admin view, and setting the edit/create site view to 'Add+Menu', the resulting model has some editing permission checks that stops non logged in users to access the items. Screenshot from the model getItem function:  Now if i want to use the helper function from the componenthelper 'getModel' i get an 'not authorised' error for public users  In this case editing access should be required for visibility access ### Steps to reproduce the Bug 1) Create admin view 2) Link admin view to component and select Edit/Create Site View => 'Add+Menu' 3) Get the model for admin view 4) Use ->getItem() function while being a non logged in user. 5) Error shown 'Not authorised!' ### Which Joomla version are you compiling in? 5.4.3 ### Which PHP version are you compiling in? 8.1 ### Which Joomla versions are you targeting? 5.4.3 ### Which PHP version are you targeting? 8.1 ### Which Web server is JCB running on? Ubuntu ### Which Relational Database is JCB running on? MariaDB ### Which OS is JCB running on? Centos ### Which JCB version are you using? 5.1.4 stable ### Where in JCB did this issue occur? Compilation of a component ### On which browsers did you encounter the issue? Firefox, Chrome ### Additional Comments _No response_

afbeelding.png

62 KiB

afbeelding.png

13 KiB

SimonvanDoorne added the Bug label 2026-03-11 12:07:24 +00:00

Llewellyn commented 2026-03-11 15:39:03 +00:00

Owner

Copy link

Copy source

What happen if you remove access from the linked view? I mean when you like the view, to not check the access checkbox.

This will remove the access control from the view and all places its linked.

What happen if you remove `access` from the linked view? I mean when you like the view, to not check the access checkbox.  This will remove the access control from the view and all places its linked.

image.png

38 KiB

SimonvanDoorne commented 2026-03-12 09:19:45 +00:00

Author

Member

Copy link

Copy source

With these settings the edit access check is still in the model

Model generated:

With these settings the edit access check is still in the model  Model generated: 

afbeelding.png

102 KiB

afbeelding.png

77 KiB

Llewellyn commented 2026-03-13 17:51:36 +00:00

Owner

Copy link

Copy source

That is not access check but basic edit check, and that will always need to be there... and if you want the public to access that form, then give them edit access.

That is how even articles work, or am I missing something here?

That is not access check but basic edit check, and that will always need to be there... and if you want the public to access that form, then give them edit access. That is how even articles work, or am I missing something here?

Llewellyn commented 2026-03-13 17:56:24 +00:00

Owner

Copy link

Copy source

Hmm I see you just want to get the data... that is why we build the dynamicGet area, and we also now have the Data factory... I would rather use those, as it avoids opening the model to attack...

Hmm I see you just want to get the data... that is why we build the dynamicGet area, and we also now have the Data factory... I would rather use those, as it avoids opening the model to attack...

Llewellyn commented 2026-03-14 10:08:42 +00:00

Owner

Copy link

Copy source

A New Data Access Engine in JCB

Recently we introduced a new data access engine in Joomla Component Builder (JCB) that makes working with database data much simpler and more flexible.

This engine allows you to retrieve and store data without worrying about how it is stored internally.

Normally when working with Joomla models or database queries you must remember details such as:

• Whether the data is stored as JSON
• Whether it is Base64 encoded
• Whether fields require special decoding
• Whether the structure needs additional processing

With this engine, you don't need to think about any of that.

The system uses the JCB-generated table metadata to determine:

• the field datatype
• how the data is stored
• how it should be decoded
• how it should be validated when saving

It then automatically prepares the data so that what you receive is ready to use in PHP.

---

Why This Exists

The Joomla model layer is powerful and still plays an important role in JCB. It provides:

• structured MVC behavior
• permission integration
• Joomla-standard workflows

However, sometimes you need more freedom.

This new engine allows you to:

• retrieve data anywhere in your code
• bypass unnecessary model overhead
• work with data quickly and safely
• control permissions yourself instead of relying on the model

So instead of Joomla enforcing permission checks through the model layer, you decide when permissions apply.

For example:

if ($user->authorise('core.edit', 'com_example'))
{
    // fetch data
}

This puts full control back into the developer's hands.

---

Automatic Data Handling

The engine automatically handles:

• JSON decoding
• Base64 decoding
• datatype validation
• correct value formatting when saving

If you attempt to save an incorrect datatype (for example a string where an integer is required), the engine will throw an error immediately.

This helps prevent corrupt data from ever reaching the database.

---

Automatic Insert or Update

The engine also provides a simple set() workflow.

When saving data:

• If the record exists → it updates
• If the record does not exist → it creates a new record

You don't need to manually determine whether to run an INSERT or UPDATE.

---

Cross-Table Flexibility

For more advanced cases, the engine can also operate across multiple tables.

This is the same mechanism used in the demo component example where:

• Subform data is stored in a separate relational table
• Instead of being stored as a JSON blob

This approach makes it far easier to:

• search
• filter
• join tables
• scale large datasets

---

Architecture

The engine uses a factory-based container to provide access to services.

This means:

• objects are reused instead of repeatedly instantiated
• dependency injection remains clean
• the system remains easy to extend

If you prefer, you can even:

• create your own factory
• implement your own classes
• extend the interfaces provided

This keeps the system both stable and customizable.

---

Automatic Code Import in JCB

When you use these examples in your project:

JCB will automatically detect the Power classes being used and import all required code into your project.

Once imported, you can edit or extend them inside the JCB Powers area.

---

Example: Get a Single Item

This example retrieves a single record from a table.

// check the class details here:
// https://git.vdm.dev/joomla/super-powers/src/branch/master/src/9206082e-a3f7-472e-98b2-de90d06cbdcd

$item = Super___9d76b8dc_3883_4755_b11c_131d19ca8a53___Power::('Item')
	->table('#__other_component_table_name')
	->get($id, 'id'); // in other component

What happens here:

1. The Item service is requested from the container.
2. The database table is defined.
3. The get() method retrieves the record where id = $id.

The returned value is already:

• decoded
• validated
• properly structured

---

Example: Get Multiple Items

You can also retrieve multiple items in a single call.

// check the class details here:
// https://git.vdm.dev/joomla/super-powers/src/branch/master/src/21bca8a4-5b28-41c4-843e-8097f0ba7cca

$items = Super___9d76b8dc_3883_4755_b11c_131d19ca8a53___Power::('Items')
	->table('table_name')
	->get([$id], 'id'); // in current component

This retrieves a collection of records matching the provided IDs.

Again, the data returned is already normalized according to the JCB table definitions.

---

When Should You Use This?

This engine is ideal when you want:

• fast and flexible data access
• minimal boilerplate code
• automatic datatype handling
• complete control over permissions
• simple insert/update behavior

For standard Joomla workflows the model layer still remains excellent, but when you need something lighter and more direct, this engine provides a powerful alternative.

# A New Data Access Engine in JCB Recently we introduced a new data access engine in **Joomla Component Builder (JCB)** that makes working with database data much simpler and more flexible. This engine allows you to **retrieve and store data without worrying about how it is stored internally**. Normally when working with Joomla models or database queries you must remember details such as: * Whether the data is stored as **JSON** * Whether it is **Base64 encoded** * Whether fields require **special decoding** * Whether the structure needs additional processing With this engine, you don't need to think about any of that. The system uses the **JCB-generated table metadata** to determine: * the field datatype * how the data is stored * how it should be decoded * how it should be validated when saving It then automatically prepares the data so that what you receive is **ready to use in PHP**. --- # Why This Exists The Joomla model layer is powerful and still plays an important role in JCB. It provides: * structured MVC behavior * permission integration * Joomla-standard workflows However, sometimes you need **more freedom**. This new engine allows you to: * retrieve data anywhere in your code * bypass unnecessary model overhead * work with data quickly and safely * control permissions yourself instead of relying on the model So instead of Joomla enforcing permission checks through the model layer, **you decide when permissions apply**. For example: ```php if ($user->authorise('core.edit', 'com_example')) { // fetch data } ``` This puts **full control back into the developer's hands**. --- # Automatic Data Handling The engine automatically handles: * JSON decoding * Base64 decoding * datatype validation * correct value formatting when saving If you attempt to save an incorrect datatype (for example a string where an integer is required), the engine will **throw an error immediately**. This helps prevent corrupt data from ever reaching the database. --- # Automatic Insert or Update The engine also provides a **simple `set()` workflow**. When saving data: * If the record exists → it **updates** * If the record does not exist → it **creates a new record** You don't need to manually determine whether to run an `INSERT` or `UPDATE`. --- # Cross-Table Flexibility For more advanced cases, the engine can also operate across multiple tables. This is the same mechanism used in the **demo component example** where: * Subform data is stored in a **separate relational table** * Instead of being stored as a JSON blob This approach makes it far easier to: * search * filter * join tables * scale large datasets --- # Architecture The engine uses a **factory-based container** to provide access to services. This means: * objects are reused instead of repeatedly instantiated * dependency injection remains clean * the system remains easy to extend If you prefer, you can even: * create your own factory * implement your own classes * extend the interfaces provided This keeps the system both **stable and customizable**. --- # Automatic Code Import in JCB When you use these examples in your project: JCB will automatically detect the **Power classes** being used and import all required code into your project. Once imported, you can edit or extend them inside the **JCB Powers area**. --- # Example: Get a Single Item This example retrieves a single record from a table. ```php // check the class details here: // https://git.vdm.dev/joomla/super-powers/src/branch/master/src/9206082e-a3f7-472e-98b2-de90d06cbdcd $item = Super___9d76b8dc_3883_4755_b11c_131d19ca8a53___Power::('Item') ->table('#__other_component_table_name') ->get($id, 'id'); // in other component ``` What happens here: 1. The **Item service** is requested from the container. 2. The database **table is defined**. 3. The `get()` method retrieves the record where `id = $id`. The returned value is already: * decoded * validated * properly structured --- # Example: Get Multiple Items You can also retrieve multiple items in a single call. ```php // check the class details here: // https://git.vdm.dev/joomla/super-powers/src/branch/master/src/21bca8a4-5b28-41c4-843e-8097f0ba7cca $items = Super___9d76b8dc_3883_4755_b11c_131d19ca8a53___Power::('Items') ->table('table_name') ->get([$id], 'id'); // in current component ``` This retrieves a **collection of records** matching the provided IDs. Again, the data returned is already normalized according to the **JCB table definitions**. --- # When Should You Use This? This engine is ideal when you want: * fast and flexible data access * minimal boilerplate code * automatic datatype handling * complete control over permissions * simple insert/update behavior For standard Joomla workflows the **model layer still remains excellent**, but when you need something lighter and more direct, this engine provides a powerful alternative.

SimonvanDoorne commented 2026-03-17 10:18:06 +00:00

Author

Member

Copy link

Copy source

Thank you for the explanation, however, i don't read anything about the php you can insert in the getItem method through the admin view tab 'php', do we have to reimplement that code using the Data factory, or does the Data Factory include this natively?

As a note, the Joomla core does not check for editing permissions in their getItem models. A couple of examples:
com_category -> CategoryModel
com_fields -> FieldModel
com_content -> ArticleModel
None of these check for editing permissions

Thank you for the explanation, however, i don't read anything about the php you can insert in the getItem method through the admin view tab 'php', do we have to reimplement that code using the Data factory, or does the Data Factory include this natively?  As a note, the Joomla core does **not** check for editing permissions in their getItem models. A couple of examples: com_category -> CategoryModel com_fields -> FieldModel com_content -> ArticleModel None of these check for editing permissions

afbeelding.png

45 KiB

Llewellyn commented 2026-03-17 11:03:40 +00:00

Owner

Copy link

Copy source

Okay, I see you have custom code in your model, and moving that is a pain.

The validation of access in the model, and not only in the controller is due to a security issue.

I get the point that this is annoying. Maybe use the replace custom code convention and remove it… that will be the easiest workaround for now.

We can’t at this time remove it. I will continue to keep an eye on this, and as soon as we can ensure no direct model access is possible via url we can look at removing this check.

Okay, I see you have custom code in your model, and moving that is a pain. The validation of access in the model, and not only in the controller is due to a security issue. I get the point that this is annoying. Maybe use the replace custom code convention and remove it… that will be the easiest workaround for now. We can’t at this time remove it. I will continue to keep an eye on this, and as soon as we can ensure no direct model access is possible via url we can look at removing this check.

Llewellyn commented 2026-03-17 19:07:08 +00:00

Owner

Copy link

Copy source

So you in your IDE just add:

/***[REPLACE<>$$$$]***/
// code removed
/***[/REPLACE<>$$$$]***/

Around the code you want to remove, then compile once, and install and from there JCB will keep removing that part, until it changes (meaning we change JCB core in that area enough that it will impact your model in that area) and then you will get a notice, to have a look and either remove the code again or now use the changes we made... so it remains a final resort, but still useful and quick way, for when JCB is not doing things the way you would like it.

So you in your IDE just add: ``` /***[REPLACE<>$$$$]***/ // code removed /***[/REPLACE<>$$$$]***/ ``` Around the code you want to remove, then compile once, and install and from there JCB will keep removing that part, until it changes (meaning we change JCB core in that area enough that it will impact your model in that area) and then you will get a notice, to have a look and either remove the code again or now use the changes we made... so it remains a final resort, but still useful and quick way, for when JCB is not doing things the way you would like it.

SimonvanDoorne commented 2026-03-23 14:07:56 +00:00

Author

Member

Copy link

Copy source

Thank you for the info! I'll use the custom code replacements and go from there!

Thank you for the info! I'll use the custom code replacements and go from there!

SimonvanDoorne closed this issue 2026-03-23 14:07:57 +00:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

6.x

5.x

4.x

3.x

v6.2.0

v5.2.0

v4.2.0

v6.1.6

v5.1.6

v4.1.5

v6.1.5

v5.1.5

v4.1.4

v6.1.4

v5.1.4

v4.1.3

v6.1.3

v5.1.3

v6.1.2

v5.1.2

v4.1.2

v5.1.1

v4.1.1

v4.1.0

v3.2.5

v5.1.0

v5.0.3

v4.0.3

v3.2.4

v5.0.2

v4.0.2

v3.2.3

v5.0.1

v4.0.1

v3.2.2

v5.0.0

v4.0.0

v3.2.1

v3.2.0

v3.1.28

v3.1.27

v3.1.26

v3.1.24

v3.1.19

v3.1.17

v3.1.15

v3.1.12

v3.1.11

v3.1.10

v3.1.9

v3.1.8

v3.1.7

v3.1.6

v3.1.5

v3.1.4

v3.1.3

v3.1.2

v2.13.1

v2.13.0

v2.12.16

v2.12.15

v2.12.14

v2.12.10

v2.12.9

v2.12.8

v2.12.7

v2.12.6

v2.12.4

v2.12.3

v2.12.2

v2.11.7

v2.11.4

v2.11.3

v2.11.2

v2.11.0

v2.10.13

v2.10.11

v2.10.9

v2.10.5

v2.10.1

v2.10.0

v2.9.21

v2.9.18

v2.9.14

v2.9.11

v2.9.10

v2.9.8

v2.9.7

v2.9.1

v2.9.0

v2.8.5

v2.8.4

v2.8.2

v2.8.0

v2.7.10

v2.7.7

v2.7.6

v2.7.5

v2.7.4

v2.7.1

v2.7.0

v2.6.17

v2.6.16

v2.6.15

v2.6.14

v2.6.13

v2.6.12

v2.6.11

v2.6.10

v2.6.9

v2.6.8

v2.6.7

v2.6.6

v2.6.5

v2.6.3

v2.6.2

v2.6.1

v2.6.0

v2.5.8

v2.5.6

v2.5.5

v2.5.4

v2.5.1

v2.5.0

v2.4.10

v2.4.9

v2.4.8

v2.4.7

v2.4.6

v2.4.5

v2.4.4

v2.4.3

v2.4.2

v2.4.1

v2.4.0

v2.3.10

v2.3.9

v2.3.8

v2.3.7

v2.3.6

v2.3.5

v2.3.4

v2.3.2

v2.3.1

v2.3.0

v2.2.10

v2.2.9

v2.2.6

v2.2.5

v2.2.4

v2.2.3

v2.2.2

v2.2.0

v2.1.21

v2.1.20

v2.1.19

v2.1.18

v2.1.17

v2.1.16

v2.1.14

v2.1.13

v2.1.12

v2.1.11

v2.1.10

v2.1.9

v2.1.8

v2.1.7

v2.1.6

v2.1.5

v2.1.4

v2.1.3

v2.1.2

v2.1.1

v2.1.0

v2.0.9

v2.0.8

Labels

Clear labels

Beta

Issues related to the a beta release

Bug

Documentation

URGENT

enhancement

help wanted

invalid

joomla

Joomla related changes

question

wontfix

No labels Bug

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

aamigo Eunice Hannah Jeff Lemuel Llewellyn Malachi Roline vistamedia Martin (Martin Kopp) aB0t (Robot) ro-ot (root) TLWebdesign (Tom van der Laan)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: joomla/Component-Builder#1295