From 677ff59d0474dce397af43676573499e0e27c73e Mon Sep 17 00:00:00 2001
From: Zeegaan <skrivdetud@gmail.com>
Date: Tue, 12 Dec 2023 14:35:29 +0100
Subject: [PATCH] Loosen up policies so editors can get what they need

---
 src/Umbraco.Web.BackOffice/Controllers/LanguageController.cs  | 4 +++-
 .../Controllers/StylesheetController.cs                       | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/Umbraco.Web.BackOffice/Controllers/LanguageController.cs b/src/Umbraco.Web.BackOffice/Controllers/LanguageController.cs
index aaf067022c..285e1127eb 100644
--- a/src/Umbraco.Web.BackOffice/Controllers/LanguageController.cs
+++ b/src/Umbraco.Web.BackOffice/Controllers/LanguageController.cs
@@ -18,7 +18,6 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers;
 ///     Backoffice controller supporting the dashboard for language administration.
 /// </summary>
 [PluginController(Constants.Web.Mvc.BackOfficeApiArea)]
-[Authorize(Policy = AuthorizationPolicies.SectionAccessSettings)]
 public class LanguageController : UmbracoAuthorizedJsonController
 {
     private readonly ILocalizationService _localizationService;
@@ -43,6 +42,7 @@ public class LanguageController : UmbracoAuthorizedJsonController
     /// </summary>
     /// <returns></returns>
     [HttpGet]
+    [Authorize(Policy = AuthorizationPolicies.TreeAccessLanguages)]
     public IDictionary<string, string> GetAllCultures()
         => CultureInfo.GetCultures(CultureTypes.AllCultures).DistinctBy(x => x.Name).OrderBy(x => x.EnglishName)
             .ToDictionary(x => x.Name, x => x.EnglishName);
@@ -52,6 +52,7 @@ public class LanguageController : UmbracoAuthorizedJsonController
     /// </summary>
     /// <returns></returns>
     [HttpGet]
+    [Authorize(Policy = AuthorizationPolicies.SectionAccessContent)]
     public IEnumerable<Language>? GetAllLanguages()
     {
         IEnumerable<ILanguage> allLanguages = _localizationService.GetAllLanguages();
@@ -60,6 +61,7 @@ public class LanguageController : UmbracoAuthorizedJsonController
     }
 
     [HttpGet]
+    [Authorize(Policy = AuthorizationPolicies.TreeAccessLanguages)]
     public ActionResult<Language?> GetLanguage(int id)
     {
         ILanguage? lang = _localizationService.GetLanguageById(id);
diff --git a/src/Umbraco.Web.BackOffice/Controllers/StylesheetController.cs b/src/Umbraco.Web.BackOffice/Controllers/StylesheetController.cs
index 616edfa04f..1fc5f641f6 100644
--- a/src/Umbraco.Web.BackOffice/Controllers/StylesheetController.cs
+++ b/src/Umbraco.Web.BackOffice/Controllers/StylesheetController.cs
@@ -14,7 +14,7 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers;
 ///     The API controller used for retrieving available stylesheets
 /// </summary>
 [PluginController(Constants.Web.Mvc.BackOfficeApiArea)]
-[Authorize(Policy = AuthorizationPolicies.SectionAccessSettings)]
+[Authorize(Policy = AuthorizationPolicies.SectionAccessContent)]
 public class StylesheetController : UmbracoAuthorizedJsonController
 {
     private readonly IFileService _fileService;