Custom Pages module ignores permission system, hardcoded admin-only access

[gauravsdcube]

Description
The Custom Pages module does not properly respect HumHub's permission system. Even when non-admin groups are granted the "Manage custom pages" permission, they cannot access custom page management due to hardcoded isAdmin() checks that bypass the permission system.

Steps to Reproduce

Create a custom group (e.g., "Client Administrator")
Go to Administration → Users → Groups → [Your Group] → Permissions
Grant the group "Custom Pages" → "Manage custom pages" permission
Assign a user to this group
Log in as the user from step 4
Attempt to access custom pages management

Expected Behavior
Users with the "Manage custom pages" permission should be able to:

Access /custom_pages/admin
Create, edit, and delete custom pages
Edit HTML content in custom pages

Actual Behavior
Users get the error: "Oooops... It looks like you may have taken the wrong turn. You cannot manage the page!"

[luke-]

Which version are you using?

[gauravsdcube]

Custom pages version 1.10.15 from marketplace

Humhub Version: 1.17.3

[luke-]

If you like you can check the beta 1.11, there the permission usage should be fixed.

[gauravsdcube]

@luke- how do I check beta 1.11. I couldn't see a branch for this.

[luke-]

@gauravsdcube You can enable Beta Versions in the Marketplace Admin:

[gauravsdcube]

Thanks Luke. I did that and it gave me an error message and now the whole module is gone. I got the following error when I updated the module yii\base\ErrorException: require(/var/www/humhub/protected/modules/custom_pages/vendor/autoload.php): Failed to open stream: No such file or directory in /var/www/humhub/protected/modules/custom_pages/Events.php:48 Stack trace: #0 /var/www/humhub/protected/modules/custom_pages/Events.php(48): yii\base\ErrorHandler->handleError() #1 /var/www/humhub/protected/modules/custom_pages/Events.php(48): require() #2 /var/www/humhub/protected/modules/custom_pages/Events.php(34): humhub\modules\custom_pages\Events::registerAutoloader() #3 [internal function]: humhub\modules\custom_pages\Events::onBeforeRequest() #4 /var/www/humhub/protected/vendor/yiisoft/yii2/base/Event.php(312): call_user_func() #5 /var/www/humhub/protected/vendor/yiisoft/yii2/base/Component.php(657): yii\base\Event::trigger() #6 /var/www/humhub/protected/vendor/yiisoft/yii2/base/Application.php(381): yii\base\Component->trigger() #7 /var/www/humhub/index.php(34): yii\base\Application->run() #8 {main} I am also unable to install the original module now. Gaurav From: Lucas Bartholemy ***@***.***> Date: Wednesday, 20 August 2025 at 16:20 To: humhub/custom-pages ***@***.***> Cc: Gaurav Shrivastava ***@***.***>, Mention ***@***.***> Subject: Re: [humhub/custom-pages] Custom Pages module ignores permission system, hardcoded admin-only access (Issue #461) [https://avatars.githubusercontent.com/u/4736168?s=20&v=4]luke- left a comment (humhub/custom-pages#461)<#461 (comment)> @gauravsdcube<https://github.com/gauravsdcube> You can enable Beta Versions in the Marketplace Admin: image.png (view on web)<https://github.com/user-attachments/assets/a066798b-a077-4de9-ad92-d437b5d94b39> — Reply to this email directly, view it on GitHub<#461 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BTHDMOKBZLWZGXI4C2C7Y4T3OSGZZAVCNFSM6AAAAACEFCWFESVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTEMBWHA2TIMZVGY>. You are receiving this because you were mentioned.

[luke-]

@gauravsdcube What steps did you take to update the module?

[gauravsdcube]

I enabled the beta version in Marketplace settings and then updated the module by clicking on Update option. I have managed to recover the module and it is now working fine and I can see it is a newer version. Gaurav From: Lucas Bartholemy ***@***.***> Date: Wednesday, 20 August 2025 at 17:05 To: humhub/custom-pages ***@***.***> Cc: Gaurav Shrivastava ***@***.***>, Mention ***@***.***> Subject: Re: [humhub/custom-pages] Custom Pages module ignores permission system, hardcoded admin-only access (Issue #461) [https://avatars.githubusercontent.com/u/4736168?s=20&v=4]luke- left a comment (humhub/custom-pages#461)<#461 (comment)> @gauravsdcube<https://github.com/gauravsdcube> What steps did you take to update the module? — Reply to this email directly, view it on GitHub<#461 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BTHDMOLQHM6SLQK432FUEX33OSMFTAVCNFSM6AAAAACEFCWFESVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTEMBXGAYDSMZVGY>. You are receiving this because you were mentioned.