Template Access Control: Missing Constraint on Guest Edit Permission
29.5K reputation · 18 May 2023, 07:43 UTC
Goal: Prevent the guest role from being granted edit access through template access settings unless the template explicitly permits it, thereby avoiding unintended editing privileges for anonymous users.
Uncertainty: The template editor does not display a warning or constraint when assigning edit permission to the guest role, and it is unclear whether edit permissions defined on a parent template are automatically inherited by child templates that do not override their own access settings.
- Is there a built‑in configuration or hook that blocks guest edit access unless explicitly allowed?
- How can administrators enforce a restriction that guest users never receive edit permission via template settings?
- When a child template inherits access settings from its parent, are edit permissions propagated to roles that lack explicit child‑template overrides?