Non-Draft "Default moderation state" breaks when "Moderation state" field is hidden from entity form

Created on 31 December 2019, almost 5 years ago
Updated 19 September 2024, 2 months ago

Normally, if the user creating an entity doesn't have permission to transition to the state set as the Default moderation state for that entity, the system will default to the first listed state to which they do have permission. (See #2856967: Allow admins to select a default entity moderation state β†’ )

However, if the "Moderation state" field is not shown (disabled) on the entity form display, the entity will be saved with the default workflow state -- even though the user shouldn't be allowed to do that.

For instance (and to be specific), if:

  • "Basic page" content type uses "Editorial" workflow, and
  • "Editorial" workflow has default "Draft" and "Published" states and transitions, and
  • "Default moderation state" for the workflow is set to "Published", and
  • "Authenticated user" role has "Approval workflow: Use Create New Draft transition" permission, and
  • "Authenticated user" role does not have "Approval workflow: Use Publish transition" permission, and
  • On the "Manage form display" for "Basic page", the "Content moderation" field is disabled...

Then when a non-administrative user creates a Basic page:

  • the "Content moderation field" is not shown on the form -- as intended -- and
  • when saved, the workflow state of the node created is "Published" -- which should not be allowed.

I ran into this issue because I have separate form view modes for author and editor, with the editor's view mode not showing the moderation field.

πŸ› Bug report
Status

Active

Version

11.0 πŸ”₯

Component
Content moderationΒ  β†’

Last updated 1 day ago

  • Maintained by
  • πŸ‡¦πŸ‡ΊAustralia @Sam152
Created by

πŸ‡ΊπŸ‡ΈUnited States jeffschuler Boulder, Colorado

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡¨πŸ‡¦Canada liquidcms

    I also want to hide/disable the moderation state field on the edit form as i only want editors to access state changes through the moderation control block.

    setting either:

    $form["moderation_state"]["widget"][0]["state"]['#disabled'] = true;
    or
    $form["moderation_state"]["widget"][0]["state"]['#access'] = true;

    attempts to leave the Published state as Published even though workflow want to force it to Draft. And in the case of #disabled, where i can still see the selection, it is selecting Draft but in all cases i get error saying Live to Live is not a valid transition (which it isn't).

    I would think either hidden or disabled should still allow workflow default transitions to occur.

  • Hi,
    If we update the hidden or disable the moderation state field in the content form. If user want to change the state from one state to another state is not possible for the editor.

  • Hi
    I tried the following methods to check whether the permission for the content moderation in editorial user.

    1. Created a new service for checking the permission with the user that the access or moderation field is disabled or not in the condition.
    2. In the validator check that the user has the permission and the content moderation state is disabled for the user or not.
    3. In the validator itself check that user workflow moderation content state for permission is allowed or not.

    This is the Code is already checking the permission. Even the conditon for checking permission also working properly but addviolation constraint message is not coming.

    if (!$this->stateTransitionValidation->isTransitionValid($workflow, $original_state, $new_state, $this->currentUser, $entity)) {
            $this->context->addViolation($constraint->invalidTransitionAccess, [
              '%original_state' => $original_state->label(),
              '%new_state' => $new_state->label(),
            ]);
          }
    

    Please let me know incase if I miss anything or Can suggest any new methods to fix the issue.

Production build 0.71.5 2024