modxcms · Ibochkarev · Aug 18, 2026
@@ -0,0 +1,131 @@
+<?php
+
+/*
+ * This file is part of the MODX Revolution package.
+ *
+ * Copyright (c) MODX, LLC
+ *
+ * For complete copyright and license information, see the COPYRIGHT and LICENSE
+ * files found in the top-level directory of this distribution.
+ *
+ * @package modx-test
+*/
+namespace MODX\Revolution\Tests\Model\Security;
+
+use MODX\Revolution\MODxTestCase;
+use MODX\Revolution\Processors\Security\Group\Create as UserGroupCreate;
+use ReflectionClass;
+
+/**
+ * Guards ACL permission keys for issue #14497.
+ *
+ * @group Model
+ * @group Security
+ * @group AccessPermissions
+ */
+class AccessPermissionUiTest extends MODxTestCase
+{
+    public function testUserGroupCreateProcessorUsesUsergroupNew(): void
+    {
+        $defaults = (new ReflectionClass(UserGroupCreate::class))->getDefaultProperties();
+
+        $this->assertSame('usergroup_new', $defaults['permission']);
+    }
+
+    public function testUserGroupAclGridCreateUsesUsergroupNew(): void
+    {
+        $source = $this->readManagerAsset('assets/modext/widgets/security/modx.grid.user.group.base.js');
+
+        $this->assertStringContainsString(
+            "this.setUserCanCreate(['usergroup_new', 'usergroup_save']);",
+            $source
+        );
+        $this->assertStringNotContainsString(
+            "setUserCanCreate(['usergroup_create'",
+            $source
+        );
+        $this->assertStringContainsString(
+            'hidden: !MODx.perm.usergroup_new || !MODx.perm.usergroup_save',
+            $source
+        );
+        $this->assertStringContainsString('getCreateAclButton', $source);
+        $this->assertStringNotContainsString('hideCreateAclButtonWithoutPermission', $source);
+    }
+
+    /**
+     * @dataProvider providerAclGridCreateButtons
+     */
+    public function testAclGridsUseCreateAclButtonFactory(string $relativePath): void
+    {
+        $source = $this->readManagerAsset($relativePath);
+
+        $this->assertStringContainsString('this.getCreateAclButton(_(', $source);
+    }
+
+    public function providerAclGridCreateButtons(): array
+    {
+        $dir = 'assets/modext/widgets/security/';
+
+        return [
+            'context' => [$dir . 'modx.grid.user.group.context.js'],
+            'category' => [$dir . 'modx.grid.user.group.category.js'],
+            'namespace' => [$dir . 'modx.grid.user.group.namespace.js'],
+            'source' => [$dir . 'modx.grid.user.group.source.js'],
+            'resource' => [$dir . 'modx.grid.user.group.resource.js'],
+        ];
+    }
+
+    public function testUserGroupTreeGatesCreateAndAddUser(): void
+    {
+        $source = $this->readManagerAsset('assets/modext/widgets/security/modx.tree.user.group.js');
+
+        $this->assertStringContainsString(
+            'hidden: !MODx.perm.usergroup_new || !MODx.perm.usergroup_save',
+            $source
+        );
+        $this->assertStringContainsString(
+            'MODx.perm.usergroup_user_edit && MODx.perm.usergroup_user_list',
+            $source
+        );
+        $this->assertStringContainsString(
+            'MODx.perm.usergroup_new && MODx.perm.usergroup_save && ui.hasClass(\'pcreate\')',
+            $source
+        );
+    }
+
+    public function testUserGroupUsersGridAddRequiresListPermission(): void
+    {
+        $source = $this->readManagerAsset('assets/modext/widgets/security/modx.panel.user.group.js');
+
+        $this->assertStringContainsString(
+            '!this.userCanEditGroupUsers || !MODx.perm.usergroup_user_list',
+            $source
+        );
+    }
+
+    public function testDeleteRoleLexiconDoesNotSayRemove(): void
+    {
+        $lexicon = file_get_contents(MODX_CORE_PATH . 'lexicon/en/permissions.inc.php');
+
+        $this->assertNotFalse($lexicon);
+        $this->assertStringContainsString(
+            "\$_lang['perm.delete_role_desc'] = 'To delete any Roles.';",
+            $lexicon
+        );
+        $this->assertStringNotContainsString(
+            "\$_lang['perm.delete_role_desc'] = 'To delete or remove any Roles.';",
+            $lexicon
+        );
+    }
+
+    private function readManagerAsset(string $relativePath): string
+    {
+        $path = MODX_MANAGER_PATH . $relativePath;
+        $this->assertFileExists($path);
+
+        $source = file_get_contents($path);
+        $this->assertNotFalse($source);
+
+        return $source;
+    }
+}
@@ -35,7 +35,7 @@
 $_lang['perm.delete_eventlog_desc'] = 'To empty the Event Log.';
 $_lang['perm.delete_plugin_desc'] = 'To delete or remove any Plugins.';
 $_lang['perm.delete_propertyset_desc'] = 'To delete or remove any Property Sets.';
-$_lang['perm.delete_role_desc'] = 'To delete or remove any Roles.';
+$_lang['perm.delete_role_desc'] = 'To delete any Roles.';
 $_lang['perm.delete_snippet_desc'] = 'To delete or remove any Snippets.';
 $_lang['perm.delete_template_desc'] = 'To delete or remove any Templates.';
 $_lang['perm.delete_tv_desc'] = 'To delete or remove any TVs.';

@@ -59,7 +59,7 @@ MODx.grid.UserGroupBase = function UserGroupBase(config = {}) {
 
     this.setUserCanEdit(['usergroup_edit', 'usergroup_save']);
     this.userCanEditAcls = this.userCanEdit;
-    this.setUserCanCreate(['usergroup_create', 'usergroup_save']);
+    this.setUserCanCreate(['usergroup_new', 'usergroup_save']);
     this.setUserCanDelete(['usergroup_delete']);
     this.setShowActionsMenu();
 
@@ -83,6 +83,15 @@ MODx.grid.UserGroupBase = function UserGroupBase(config = {}) {
 };
 Ext.extend(MODx.grid.UserGroupBase, MODx.grid.Grid, {
     windows: {},
+    getCreateAclButton: function(text) {
+        return {
+            text: text,
+            cls: 'primary-button',
+            scope: this,
+            handler: this.createAcl,
+            hidden: !MODx.perm.usergroup_new || !MODx.perm.usergroup_save
+        };
+    },
     getColumns: function(columns) {
         this.rowExpander = new Ext.grid.RowExpander({
             tpl: new Ext.XTemplate(

@@ -61,12 +61,7 @@ MODx.grid.UserGroupCategory = function UserGroupCategory(config = {}) {
             }
         ]),
         tbar: [
-            {
-                text: _('category_add'),
-                cls: 'primary-button',
-                scope: this,
-                handler: this.createAcl
-            },
+            this.getCreateAclButton(_('category_add')),
             '->',
             {
                 xtype: 'modx-combo-category',

@@ -56,12 +56,7 @@ MODx.grid.UserGroupContext = function UserGroupContext(config = {}) {
             }
         ]),
         tbar: [
-            {
-                text: _('context_add'),
-                cls: 'primary-button',
-                scope: this,
-                handler: this.createAcl
-            },
+            this.getCreateAclButton(_('context_add')),
             '->',
             {
                 xtype: 'modx-combo-context',

@@ -55,12 +55,7 @@ MODx.grid.UserGroupNamespace = function UserGroupNamespace(config = {}) {
             }
         ]),
         tbar: [
-            {
-                text: _('namespace_add'),
-                cls: 'primary-button',
-                scope: this,
-                handler: this.createAcl
-            },
+            this.getCreateAclButton(_('namespace_add')),
             '->',
             {
                 xtype: 'modx-combo-namespace',

@@ -63,12 +63,7 @@ MODx.grid.UserGroupResourceGroup = function UserGroupResourceGroup(config = {})
             }
         ]),
         tbar: [
-            {
-                text: _('resource_group_add'),
-                cls: 'primary-button',
-                scope: this,
-                handler: this.createAcl
-            },
+            this.getCreateAclButton(_('resource_group_add')),
             '->',
             {
                 xtype: 'modx-combo-resourcegroup',

@@ -57,12 +57,7 @@ MODx.grid.UserGroupSource = function UserGroupSource(config = {}) {
             }
         ]),
         tbar: [
-            {
-                text: _('source_add'),
-                cls: 'primary-button',
-                scope: this,
-                handler: this.createAcl
-            },
+            this.getCreateAclButton(_('source_add')),
             '->',
             {
                 xtype: 'modx-combo-source',

@@ -441,7 +441,7 @@ MODx.grid.UserGroupUsers = function(config = {}) {
             if (!this.userCanEditGroups || grid.ownerCt.id !== 'modx-tree-panel-usergroup') {
                 buttonsToHide.push('modx-btn-user-group-edit');
             }
-            if (!this.userCanEditGroupUsers) {
+            if (!this.userCanEditGroupUsers || !MODx.perm.usergroup_user_list) {
                 buttonsToHide.push('modx-btn-user-group-add-user');
             }
             if (buttonsToHide.length > 0) {

@@ -26,6 +26,7 @@ MODx.tree.UserGroup = function(config) {
             text: _('user_group_new')
             ,cls: 'primary-button'
             ,scope: this
+            ,hidden: !MODx.perm.usergroup_new || !MODx.perm.usergroup_save
             ,handler: this.createUserGroup.createDelegate(this,[true],true)
         }]
     });
@@ -107,14 +108,14 @@ Ext.extend(MODx.tree.UserGroup,MODx.tree.Tree,{
 
         switch (n.attributes.type) {
             case 'usergroup':
-                if (MODx.perm.usergroup_user_edit && ui.hasClass('padduser')) {
+                if (MODx.perm.usergroup_user_edit && MODx.perm.usergroup_user_list && ui.hasClass('padduser')) {
                     m.push({
                         text: _('user_group_user_add')
                         ,handler: this.addUser
                     });
                     m.push('-');
                 }
-                if (MODx.perm.usergroup_new && ui.hasClass('pcreate')) {
+                if (MODx.perm.usergroup_new && MODx.perm.usergroup_save && ui.hasClass('pcreate')) {
                     m.push({
                         text: _('user_group_create')
                         ,handler: this.createUserGroup