Team,

We are not able to give permission to a secure folder in resource manager by roles other than "Administrators". We have custom role in our application and have exposed Resource Manager to manage content of the application. But after upgrading from 9.13.9 to 10.2.1, on trying to give permission to a folder getting follwoing error: "Error: Unauthorized". It is failing on call of this api -> Items/GetRoleGroups

In ItemsController.cs I can see following line which is giving this error:

 [HttpGet]
        [ValidateAntiForgeryToken]
        public IHttpActionResult GetRoleGroups()
        {
            if (!this.UserInfo.IsInRole(this.PortalSettings.AdministratorRoleName))
            {
                return this.Unauthorized();
            }

            var groups = RoleController.GetRoleGroups(this.roleProvider, this.PortalSettings.PortalId)
                            .Cast()
                            .Select(RoleGroupDto.FromRoleGroupInfo);

            return this.Ok(groups);
        }

This functionality was earlier working in 9.13.9, is this intentional change? Also I failed to understand why this check was not in other API calls in this file? I think this is independent module and we should use module permission to identify if any such security check is required.

Can you please look into it urgently.

Regards,

Alok