Content moderation info block doesn't honor Workbench access settings

Created on 10 December 2020, almost 4 years ago
Updated 9 October 2023, about 1 year ago

Content moderation info block doesn't support Workbench access

Steps to reproduce

  1. Install workbench access module.
  2. Give workbench access permission to user role like editor.
  3. Check one workbench access i.e Manager from user profile under workbench access tab.
  4. Create a content and assign a workbench on that content i.e Sales
  5. Now view that content, Content moderation info block appears on that node and user is able to change the moderation state.
Feature request
Status

Needs review

Version

1.0

Component

Code

Created by

🇮🇳India ankitv18

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇺🇸United States agentrickard Georgia (US)

    Note from the Workbench Access maintainer:

    I had the debate long ago with core maintainers about whether one should be able to moderate content you cannot edit. I lost that fight, which is why this issue exists.

    The block access check here is incorrect, IMO, it should be checking generic edit access, not specifically reproducing code from Workbecch Access.

  • 🇺🇸United States agentrickard Georgia (US)

    New merge request which implements a strict access check if required. It introduces the following changes:

    • Drupal 10 install compatibility
    • #3263108: ContentModerationInfoBlockForm - Fatal Error -- required for development
    • Fixes issue with missing default $config variable `revision_log_message_input_display`. Defaults this to FALSE since it is currently not set.
    • Adds a `require_edit_access` option to the block
    • Implements an access() check that checks entity access if required.

    TODO:

    • Tests
    • Other Drupal 10 compatibility
  • Status changed to Needs review about 1 year ago
  • @agentrickard opened merge request.
  • 🇺🇸United States agentrickard Georgia (US)

    Patch version of the current MR.

  • 🇺🇸United States kbentham

    I have modified the logic of the patch @agentrickard made slightly. I removed the access check and added some logic around just the moderation form in the info block. Users who can view the block but cant edit the entity can still view the other info without having access to update the moderation state for the entity.

  • 🇺🇸United States kbentham

    Removing the update to the version requirements as that has happened elsewhere.

Production build 0.71.5 2024