Access checks for moderated content actions are not optimal

Created on 21 September 2022, about 2 years ago
Updated 1 March 2023, over 1 year ago

Problem/Motivation

At the moment the action specific permissions (i.e. moderated content bulk draft) are access checked inside the execute method of the action plugin, and it doesn't seem like the correct place to do it, since we already have an access method in the plugin interface.
This causes notification messages which are dubious:

Also it seems like we're missing out on functionality that comes from views_bulk_operations , in regards to access checks if ViewsBulkOperationsBulkForm view field is used, instead of NodeBulkForm view field.

Steps to reproduce

Try to use one of the action operations the module provides, with a user that doesn't have a permission for that action.

Proposed resolution

Summary of proposed resolution

Move the permission as an annotation of the plugins.
Move the code that checks the permission access to the RevisionActionBase. The check will get the permission name from the plugin definition.
This should have the following effects:

  1. Make the code a bit more readable.
  2. Forbidden access messages will not be dubious, and will look like:
  3. When using ViewsBulkOperationsBulkForm, instead of NodeBulkForm, the actions that we do not have access to should automatically be hidden. See ViewsBulkOperationsBulkForm::getBulkOptions()
    Note: I haven't test this.

A bit more in depth about the proposed resolution

The Actions are based on ViewsBulkOperationsActionBase from the views_bulk_operations module.
In it's documentation it says that when annotating a ViewsBulkOperationsActionBase action plugin, you can set a _permission property, which ViewsBulkOperationsBulkForm uses for it's access checks.

💬 Support request
Status

Needs work

Version

2.0

Component

Code

Created by

🇧🇬Bulgaria ivelin.enchev

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024