MenuForm::buildOverviewTreeForm() does not check access to operations

Created on 6 October 2021, over 3 years ago

Updated 8 February 2023, about 2 years ago

Problem/Motivation

We use a hook_ENTITY_TYPE_access() to restrict access to editing some menu links.
It works fine but the Edit button is still displayed when editing the menu, so it is confusing for users.

Steps to reproduce

Create a hook like this:

function foo_menu_link_content_access(MenuLinkContentInterface $entity, string $operation) {
  if (in_array($operation, ['update', 'delete'])) {
    return AccessResult::forbidden();
  }
}

Then browse to /admin/structure/menu/manage/yourmenu.

Proposed resolution

MenuForm::buildOverviewTreeForm() should check access to each link before adding the operation.

Remaining tasks

I will submit a patch.

🐛 Bug report

Status

Needs work

Version

9.5

Component

Menu system →

Last updated about 18 hours ago

Maintained by
🇩🇪Germany @dawehner
🇺🇸United States @pwolanin

Created by

🇫🇷France prudloff Lille

Live updates comments and jobs are added and updated live.

Needs Review Queue Initiative
Used to track the progress of issues reviewed by the Drupal Needs Review Queue Initiative.

Needs tests
The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment about 2 years ago →
🇺🇸United States smustgrave
This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request → as a guide.

This will need a test case to show the issue please
Status changed to Closed: outdated 7 days ago11:34am 28 February 2025
Comment 7 days ago →
🇫🇷France prudloff Lille
I can't reproduce anymore on Drupal 11.1.3, I think this was fixed by 📌 Entity operations for menu links are hardcoded in edit menu form Fixed .

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024