K2 group permission does not work anymore in backend on v2.7.1.

We've been using "K2 > User group > Assign group permissions to these categories" in order to restrict each user group to manage items only allowed categories on K2 backend.

For example,
user group "X" is allowed to manage items (publish, ordering change, etc.) in category A and B, but not in other categories.

But I noticed that it's not working that way anymore since updated to v2.7.1.
User group "X" cannot change item ordering even in allowed categories, for example.
(Actually user can drag and reorder, but it can't be saved and reflected on frontend.)

I know if I change user group-X's permission of "Edit State" from "Not Allowed" to "Allowed" in K2 parameters, group-X users can change item ordering.
But it enables group-X users to mange ALL categories.

Before updating to v2.7.1, our configuration was working fine.
Is this a bug?

Thanks,
rikao

Hello Rikao,

By default in K2's backend users have access to all of the content.
The (K2) group's permissions that you are setting are for the frontend only.

The "Assign group permissions to these categories" setting refers to front-end editing and commenting.

Hello Krikor, thanks for your reply.

That's strange… because category restriction had been working for us also on the backend on v2.6.

Do you mean v2.7.1 changed how it works?

Thanks,
rikao

Any 2.6.x or 2.6.9?

Hi,

We checked back our logs and confirmed that we didn't face this issue until v2.7.0.
Since 2.7.1, one of our user groups , who has limited backend access to particular K2 categories, now cannot reorder items.

The thing is our website's ACL is structured based on the premise of K2's backend access controllability.
So this change is serious issue for our business!

Would there be any suggestion to solve this issue?

Thanks,
rikao

Hello Rikao,
I reinstalled K2 2.6.9 in case I was mistaken, the per-category ACL is only for the frontend.

The most likely scenario is that you were using a 3rd party extension.