I did some more investigating to see what was causing the "Administrators" checkbox to show up selected even though it was unselected before the "Save" button was hit.  Turns out, the UI bug is prevalent when UserRelatedSiteMode is enabled and the user belongs to a role in  siteSettings.SiteRootEditRoles. Since "Administrators" role was set to be a site editor for our child site (which might make little sense, but that's beside the point), when an Administrator modifies the page permissions, the following checkboxes will always appear selected even though mp_Pages table gets updated when they are first unchecked and "Save" is pressed:

1. "Administrators" under "Roles that can view this page"
2. "Administrators" under "Roles that can edit this page"
3. "Content Authors" under "Roles that can only edit this page as draft"
4. "Administrators" under "Roles that can create pages below this page"

This code snippet from PageSettings.aspx.cs is the reason they always show up selected:
 

using (IDataReader reader = Role.GetSiteRoles(siteSettings.SiteId))
{
                while (reader.Read())
                {

 

                    ListItem listItem = new ListItem();
                    listItem.Text = reader["DisplayName"].ToString();
                    listItem.Value = reader["RoleName"].ToString();

 

                    ListItem editItem = new ListItem();
                    editItem.Text = reader["DisplayName"].ToString();
                    editItem.Value = reader["RoleName"].ToString();

 

                    ListItem draftItem = new ListItem();
                    draftItem.Text = reader["DisplayName"].ToString();
                    draftItem.Value = reader["RoleName"].ToString();

 

                    ListItem childItem = new ListItem();
                    childItem.Text = reader["DisplayName"].ToString();
                    childItem.Value = reader["RoleName"].ToString();

 

                    if (
                        (pageSettings.AuthorizedRoles.LastIndexOf(listItem.Value + ";") > -1)
                        || ((isSiteEditor) && (siteSettings.SiteRootEditRoles.LastIndexOf(listItem.Value + ";") > -1))
                        )
                    {
                        listItem.Selected = true;
                    }

 

                    if (
                        (pageSettings.EditRoles.LastIndexOf(editItem.Value + ";") > -1)
                        || ((isSiteEditor) && (siteSettings.SiteRootEditRoles.LastIndexOf(listItem.Value + ";") > -1))
                        )
                    {
                        editItem.Selected = true;
                    }

 

                    if (
                        (pageSettings.DraftEditOnlyRoles.LastIndexOf(draftItem.Value + ";") > -1)
                        || ((isSiteEditor) && (siteSettings.SiteRootDraftEditRoles.LastIndexOf(listItem.Value + ";") > -1))
                        )
                    {
                        draftItem.Selected = true;
                    }

 

                    if (
                        (pageSettings.CreateChildPageRoles.LastIndexOf(childItem.Value + ";") > -1)
                        || ((isSiteEditor) && (siteSettings.SiteRootEditRoles.LastIndexOf(listItem.Value + ";") > -1))
                        )
                    {
                        childItem.Selected = true;
                    }

 

                    chkListAuthRoles.Items.Add(listItem);
                    chkListEditRoles.Items.Add(editItem);
                    chkDraftEditRoles.Items.Add(draftItem);
                    chkListCreateChildPageRoles.Items.Add(childItem);
                }
}

 

Q1: Why are these selected when an Admin or Site Editor edit page permissions? Once I understand the intended purpose of forcing them to be checked, maybe they should be disabled, so that they can't be unchecked, thus modifying the database?
Q2: Since all of our roles were defined in the root site before a child side was created, the list of roles to choose as Site Editor are the default ones.  SiteSettings.aspx.cs uses selectedSite to get a list of roles to display.  I think it would make sense to check if UseRelatedSiteMode is enabled and display roles from the site specified by the RelatedSiteID key maybe?


Also, "Roles Not allowed to edit feature instance settings" is not being enforced.  I was able to reproduce this on the demo site as well.  Take a look at the Permisssions Test page and test user.