Contrib.social

Access to 'Reset to alphabetical' denied for users without administer permission

Open on Drupal.org →
Created on 9 July 2018, over 6 years ago
Updated 24 November 2023, about 1 year ago

Reset to alphabetical button is visible if users have access to edit all terms in a vocabulary, however reset route access is determined by whether the user has administer taxonomy.

This means users without administer taxonomy can see the button, but they receive access denied when clicked.

Problem (cause)

  • Reset route uses administer taxonomy permission. (See \Drupal\taxonomy\Entity\Routing\VocabularyRouteProvider::getResetPageRoute)
  • Button visibility on is determined by checking $term->access('update') on all terms. (See $change_weight_access)

Proposed solution

  1. Create a reset-all-weights operation for vocabularies.
  2. Check administer taxonomy before checking all terms.
  3. Move all existing $change_weight_access logic to operation access
  4. Change reset route permission to use _entity_access: 'vocabulary.reset-all-weights'
  5. Check vocabulary access before showing button.

Related concerns were raised in #1848686: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission) →

🐛 Bug report
Status

Fixed

Version

9.5

Component
Taxonomy  →

Last updated 20 minutes ago

  • Maintained by
  • 🇺🇸United States @xjm
  • 🇬🇧United Kingdom @catch
Created by

🇦🇺Australia dpi Perth, Australia

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024