Error when viewing page as anonymous user with missing permissions

This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request → as a guide.

YES!! This feature would be absolutely amazing to have

Patch #10 still applies to D10

Tagging for before/after screenshots to be added to the issue summary (would be a good time to update to regular templates)

This will need test coverage but we should be able to extend existing tests already for when a content type is created, should be a good novice task.

Adding unit tests.

Adding full patch

Went ahead and added screenshots.

Testing locally on Drupal 10 creating a new content type and seeing the link.

Good job with the test!

Reading the Issue Summary I see that the proposed resolution is not following the Drupal user interface text standard → , specifically the user of 'please' → .

This is changing the UI so needs the usability tag, per the Usability → gate. I am adding the tag. Having said I think the text should also be reviewed, adding tag for a usability review.

The issue summary states that this solution is 'for the time-being'. What is the long term solution?

Thank you for having up to date screen shots available in the Issue Summary! That has saved me searching for them.

I looked at the patch as well.

1. +++ b/core/modules/node/src/NodeTypeForm.php
   @@ -8,6 +8,7 @@
   +use Drupal\Core\Url;
   

   This should be sorted.

2. +++ b/core/modules/node/tests/src/Functional/NodeTypeTest.php
   @@ -88,8 +88,11 @@ public function testNodeTypeCreation() {
   +    $this->assertTrue((bool) $type_exists, 'The new content type has been created in the database.');
   

   Since this is being changed, the message can be removed.

3. +++ b/core/modules/node/src/NodeTypeForm.php
   @@ -228,7 +229,10 @@ public function save(array $form, FormStateInterface $form_state) {
   +      $this->messenger()->addStatus($this->t('The content type %name has been added. Please remember to check <a href="@permissions_url">user permissions</a> for this content type', [
   

   s/@permission/:permission/

   That is, according to protected static function FormattableMarkup::placeholderFormat

Finally, un-assigning because that person hasn't worked on this in 3 years.

I am working on #20.

I have fixed the issue mentioned in #20 and created the MR for that. Please review.

From comment #20

The issue summary states that this solution is 'for the time-being'. What is the long term solution?

This needs to be addressed for the committers

Updating issue summary, I couldn't reproduce the crash mentioned, this issue is old and Drupal probably handle this in a best way them was when the issue was created.

applying the patch #17 works as remainder message.

I think I'm missing something here. If I create a new content type, then create content of that type without making any permission changes, an anonymous user can see that content just fine. There's a 'View published content' permission that if disabled would restrict anonymous access to content overall - there's no Content-Type-Specific setting that requires changing. Either the site lets anonymous users see published content or it doesn't. Perhaps the user that reported this was using the Node View Permissions module → ?

The permissions system is designed to gracefully block access to something vs. dumping someone into a recursion vortex, so that's a bit confusing too.

Is there a setting/use case I'm missing. I like better info, but I'm concerned this alerting users to a situation that they don't have to attend to.

Think it's just a helper comment. To remind the developer to set up their permissions. As a developer is building with admin role they may forget to setup the content type for the other roles.

To keep our options open, let's reframe this issue to focus on the problem. I agree that one potential solution is to add a reminder message for users to configure permissions properly, but there could be other solutions to the problem.

To evaluate the alternative solutions, let's take a step back and ask why we need to add this reminder message. It appears that an error occurred because the author did not grant anonymous users access to the content type. It sounds totally reasonable to not configure permissions for a content type after it has been created. This certainly shouldn't result in PHP errors, so we need to investigate further and come up with a solution to that. This way I believe we wouldn't need the message in the first place.

I am keeping this issue as postponed until we have reproducible steps for the bug.

Hi everyone, so interesting to see all the comments after I originally created this issue 3 years ago!

I cannot remember the specifics, since I no longer have access to the project. I believe bnjmnm is correct in that there was most likely a contrib module enabled to handle permissions on a more granular level.

It is very possible that this is no longer a bug since Drupal core has progressed from Drupal 8 (at the time of this issue's creation) to Drupal 11.