Additional Page Edit tabs not viewable when user doesn't have view permission for page's template

[adrianbj]

Hi @ryancramerdesign

Not sure if this is intentional or not, but seems like a bug to me. If you are editing a page with a template (so you have edit permission), but you don't have view permission (access control), then you can see the Content tab, but any additional FieldsetTabs are hidden.

I know it might seem strange to have edit but not view permission, but it still seems like a bug to me that other tabs are hidden.

Please let me know if you need any other details.

[adrianbj]

In wire/modules/Process/ProcessPageEdit/ProcessPageEdit.module at line 990:

 $showable = $this->isTrash ? 'editable' : 'viewable';                                                                                                                             
 $tabViewable = $this->page->$showable($inputfield->attr('name'));

When iterating FieldsetTabs, the code asks $page->viewable($fieldName). That call goes through PagePermissions::viewable() (wire/modules/PagePermissions.module:642), where the page-level permission check runs first (line 704):

 } else if(!$user->hasPermission("page-view", $page)) {
     // user lacks basic view permission to page                                                                                                                                   
     $viewable = false;
 }                                                                                                                                                                                 

…and only after the page is deemed viewable does it fall through to the field-level check (line 717):

  if($field && $viewable) {                                                                                                                                                         
      $viewable = $this->fieldViewable($page, $field, false);
  }

So when a user has page-edit but not page-view on the template, $page->viewable($anyField) returns false for every field, and every FieldsetTab is hidden. The default Content tab survives because it isn't a FieldsetTabOpen — it's built separately and isn't subjected to that check.

Proposed reply to post on the issue

@ryancramerdesign — traced this one. In ProcessPageEdit.module (around line 990), each FieldsetTab's visibility is decided by:

$showable = $this->isTrash ? 'editable' : 'viewable';                                                                                                                             
$tabViewable = $this->page->$showable($inputfield->attr('name'));

The viewable($fieldName) call goes through PagePermissions::viewable(), which short-circuits to false as soon as the user lacks page-view, before the field-level check
at the bottom of that method ever runs. So for a user with edit-but-not-view, every viewable($field) is false, and every FieldsetTab disappears — only the default Content tab
remains because it isn't gated through this check.

Suggested fix — fall back to editable($fieldName) in the non-trash case, since by the time we're in ProcessPageEdit we already know the user can edit the page:

$fieldName = $inputfield->attr('name');
if($this->isTrash) {                                                                                                                                                              
    $tabViewable = $this->page->editable($fieldName);
} else {                                                                                                                                                                          
    $tabViewable = $this->page->viewable($fieldName) || $this->page->editable($fieldName);
}                                                                                                                                                                                 

This preserves the existing field-level view-permission behavior for users who do have page-view, and unblocks the tabs for the edit-without-view case.