Access Control with View Own Content / View Own Entity in Core

Created on 28 October 2019, over 4 years ago
Updated 13 June 2024, 15 days ago

Hi,
Drupal has long been seriously lacking of 1 critical permission View Own Content in core. Without the said, we CANNOT even build a simple Ticketing Support System whereby each submitted ticket can only be accessed by the author and the assigned roles. How can this View Own permission be ignored as we do have the Edit Own permission in core ?

I've been relying on the Content Access Module β†’ for such a View Own permission and now the module seems dead with lots of unresolved issues. Frankly, many Access Control Modules of Drupal seem to have been Dead without further maintenance and development with the scariest wording "Use At Your Own Risk !" everywhere.

I hope that Drupal could add View Own Permission for All Entities in core instead of depending on lots of contrib modules which ended up in half-baked / unmaintained status.

Being highly secure and fine-grained in permissions is the motto of Drupal and wish that Drupal could further improve its Core Permissions. Thank you all for the hard work.

✨ Feature request
Status

Closed: duplicate

Component

Idea

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡©πŸ‡ͺGermany Anybody Porta Westfalica

    It's not only missing "View own" but also "View" permission per bundle type. And yes, both is useful for

    Currently there are some contrib modules implementing this, but it should be in core, definitely.

  • Status changed to Postponed: needs info 15 days ago
  • πŸ‡¦πŸ‡ΊAustralia pameeela

    OP says contrib is lacking for this kind of module, but that seems to have changed since? The modules listed in #5 all have stable releases for D10.

    What is the specific case for including this in core if it is satisfactorily handled in contrib?

  • πŸ‡¦πŸ‡ΊAustralia pameeela

    Just adding some stats to speak to the popularity of this feature:
    entity_bundle_permissions: 70 sites
    node_view_permissions: 9,269 sites
    entity_type_permissions: 25 sites
    content_access: 11,114 (D8+ only)

  • πŸ‡©πŸ‡ͺGermany Anybody Porta Westfalica

    @pameeela thank you for your feedback! I think there are many facets to this issue.
    From the technical perspective, I think it's important that Drupal offers a stable functionality for this typical "own" permission requirement. If I remember correctly, there are quite some flaws with the current implementations, at least outside of nodes (but I'm not sure).

    So if Drupal Core allows to cleanly and stable solve this in contrib, that might be enough indeed! (This should be checked before closing this issue).

    I *personally* think Drupal Core as a technical framework should cover / provide such "natural" things in core for entities (like the related issues are tend to). And as a developer again and again ran into situations where I was wondering about such missing pieces, especially in technical-focused Drupal projects, but I'm not the person to decide what Core should do or not.

    TL;DR: I think it would make much sense to include this as part of πŸ“Œ Introduce entity permission providers Needs work (and eventually close this as duplicate then), but the Framework Managers should decide.

  • πŸ‡¦πŸ‡ΊAustralia pameeela

    I think that the module usage suggests this isn't *that* widely needed as a feature. For my part, I have needed it on occasion but it is far from an 80% use case for me.

    So apart from it being used on most sites, another reason to add it to core would be to provide (or just unblock) extensibility for contrib. So if contrib can already do it, then it might be better off there? Because having it in contrib allows for faster innovation and more variety.

  • πŸ‡©πŸ‡ͺGermany Anybody Porta Westfalica

    Yes exactly! My favourite would be to have it *offered* by the entity permission providers, but perhaps not enabled by default, so it can be used for entity types where needed and that doesn't have to happen in UI, but can happen in contrib / custom code! :)
    Guess that would be a perfect framework support.

  • πŸ‡¦πŸ‡ΊAustralia pameeela

    So are there specific changes you would propose to core to get to the point you are after? If so, a good next step would be to update this issue summary based on that, using the template suggested on the project page β†’ . The current summary (and its tone) are not super helpful along those lines.

  • πŸ‡©πŸ‡ͺGermany Anybody Porta Westfalica

    Thanks @pameeela, I just had a look at the related issue πŸ“Œ Introduce entity permission providers Needs work
    and found these lines in the code:
    https://git.drupalcode.org/project/drupal/-/merge_requests/2912/diffs#10...

    So I think everything requested here is already existing over there. So I'd indeed suggest to close this as duplicate and proceed in the other issue.

  • Status changed to Closed: duplicate 15 days ago
  • πŸ‡¦πŸ‡ΊAustralia pameeela

    Great, thank you for confirming!

Production build 0.69.0 2024