Edit button by users without access (includes refactors to list and access control)

Created on 14 March 2019, almost 6 years ago
Updated 11 January 2023, almost 2 years ago

Though the patch does a few things, the primary motivation for this issue is that the Edit link on monitor page is visible to people even without access. So classifying this issue as a bug. Otherwise switching sensorlist to use standard entity operations, and standardise entity and route access.

The attached patch also does a few extra things as a result.

  • Switches SensorList (/admin/reports/monitoring) to use operations from listbuilder. Same strategy as other parts of core, including Views.
  • Switch column to use 'Operations' phrasing.
  • Switching to Operations also added Delete button as a side effect. Access is correctly deferred to SensorConfigAccessControlHandler
  • Implemented hook_entity_operation to retain existing SensorList functions where Details and Force Run are buttons, and located before Edit button.
  • Modified lines switches deprecated usage: urlInfo->toUrl, array() -> short syntax, etc.
  • Switch access control edit and delete routes for sensor config to use entity access instead of hard coded permission. (makes it easier to override)
  • Changed SensorConfigAccessControlHandler adding additional docs and removing deprecated usage.
  • Added 'force run' to SensorConfigAccessControlHandler retaining existing access by permission.
  • Changed 'view' in SensorConfigAccessControlHandler to return neutral instead of forbidden to allow overriding. Its not a true forbidden. Correctly cache by permission not by user.

To summarise: Existing functionality is mostly the same, apart from 'view' access op returning neutral instead of forbidden. Delete button visible on list.

🐛 Bug report
Status

Needs review

Version

1.0

Component

Code

Created by

🇦🇺Australia dpi Perth, Australia

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

No activities found.

Production build 0.71.5 2024