fix(perm): do not let normal CMS editors edit static placeholders#1187
Merged
Conversation
…roups Sitewide static placeholders should be superuser-only; remove the perm when group setup runs so legacy sites drop it on deploy. Relates-to #1171
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
wesleyboar
changed the title
wesleyboar
added a commit
that referenced
this pull request
Jun 19, 2026
## Overview Stacks on #1083. Drops the extra ContentRenderer path and duplicate settings template; `header.html` owns the static placeholder, `header_logo.html` stays settings markup as on `main`. ## Related - requires #1083 - footer Structure label: #1188 (merged to `main`) - static-placeholder perm: #1187 (merged to `main`) ## Changes - **deleted** `render.py`, `constants.py`, `header_tags`, and `header_logo_via_settings.html` - **updated** `header.html`: `{% static_placeholder "header-logo" or %}` → `header_logo.html` - **updated** `CMS_PLACEHOLDER_CONF` for `header-logo` (keeps `footer-content` with #1188) - **updated** `docs/gh-999-editable-header-plan.md` (minimal deltas) ## Testing Same as #1083 steps 1–4 after this branch is merged into `feat/GH-999-let-cms-admin-edit-header`. ## UI No new UI; structure only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Content editor groups should not be able to change sitewide static placeholders (footer, future header slots). This removes that permission when group setup runs, so existing sites drop it on the next deploy that runs the helper.
Related
Changes
del_permhelper (mirror ofadd_perm)let_view_page_and_structureto revokeCan change static placeholderinstead of granting itTesting
Can change static placeholder(or use a site that still has it).let_view_page_and_structurefor that group (same as existing group setup).Can change static placeholderin Django admin.UI
No UI change.
Notes
Includes a TODO to delete the revoke block after all sites have deployed once. Open question in code: whether “Sitewide Content Manager” should retain this permission.