diff --git a/administrator/components/com_modules/controllers/module.php b/administrator/components/com_modules/controllers/module.php index 86da955150f16..951f145fcf00e 100644 --- a/administrator/components/com_modules/controllers/module.php +++ b/administrator/components/com_modules/controllers/module.php @@ -118,14 +118,19 @@ protected function allowEdit($data = array(), $key = 'id') $recordId = (int) isset($data[$key]) ? $data[$key] : 0; $user = JFactory::getUser(); - // Check general edit permission first. + // Zero record (id:0), return component edit permission by calling parent controller method + if (!$recordId) + { + return parent::allowEdit($data, $key); + } + + // Check edit on the record asset (explicit or inherited) if ($user->authorise('core.edit', 'com_modules.module.' . $recordId)) { return true; } - // Since there is no asset tracking, revert to the component permissions. - return parent::allowEdit($data, $key); + return false; } /**