Contrib.social

Inline blocks shouldn't be editable via the normal block content UI

Open on Drupal.org →
Created on 16 August 2019, over 5 years ago
Updated 16 March 2024, 8 months ago

Problem/Motivation

Labelling this as a bug for now, but feel free to change it. It certainly feels like a bug to me but #3052042: If an inline block has been edited outside of layout builder it can't be edited in layout builder → and the code that explicitly allows this says otherwise.

The problem is, when a block is created via Layout builder (making it inline/non-reusable) and the block is referenced by a node (or whatever entity type) revision that the user can also edit, that user is able to edit the block through the entity.block_content.canonical route.

The code path that lets this happen is from the access control handler into the inline block dependency subscriber

Why is this a bug? It just doesn't seem to fit with what the rest of the solution around inline blocks is trying to achieve. For instance:

1) The block is explicitly filtered out of the block content collection
2) When the block is edited via that UI, the user is then taken to previously mentioned collection screen where the block isn't listed
3) If the user tries to edit the block again they get access denied because now the new revision is no longer referenced by the node revision they can access and the event subscriber doesn't return a dependency which returns access denied
4) The changes the user made are NEVER seen because nothing references that revision.
5) It causes bugs like #3052042: If an inline block has been edited outside of layout builder it can't be edited in layout builder →

Proposed resolution

Deny access from editing inline blocks via any UI except layout builder.

Remaining tasks

  1. Agree this is a bug
  2. Fix 'er up

User interface changes

Remove ability to edit inline blocks via the block content UI.

API changes

TBD

Data model changes

Hopefully none.

Release notes snippet

TBD

🐛 Bug report
Status

Active

Version

11.0 🔥

Component
Block content  →

Last updated about 6 hours ago

Created by

🇦🇺Australia acbramley

Live updates comments and jobs are added and updated live.
  • Blocks-Layouts

    Blocks and Layouts Initiative. See the #2811175 Add layouts to Drupal issue.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • First commit to issue fork.
  • Comment 8 months ago →
    🇺🇸United States mortona2k Seattle

    I got this started from the editing side.

    With the issue fork, you can add ?edit=UUID-FOR-THE-BLOCK-TO-EDIT, and layout builder will open the right block form on load.

    I'm not sure what it will take to link to this, but if we can get contextual links added, it should work.
    Looking for feedback on the approach and query parameter name.

    I think the ability to edit inline blocks from the front end makes the most sense for UX. I would like to see contextual links that bring up a modal. 90% of the time I'm an admin editing the latest revision and I want to save and create a revision according to the "create revision by default" setting. There may need to be some configuration options, and a confirmation form to make decisions about things depending on what state it's in. It sounds like there are a pile of technical reasons why this is hard, but it would be great to start structuring the basics and work out the edge cases over time.

    Should the issue title be changed? I think it should now be "Add contextual link to inline blocks to edit in layout builder".

    This issue component is set as block_content.module, but I think this applies to all inline blocks in layout builder.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024