Edit link in breadcrumb region shows even when user has no permission

Created on 7 November 2022, about 2 years ago
Updated 19 September 2024, 3 months ago

Problem/Motivation

The edit link in the breadcrumb region of the secondary toolbar shows even when the user does not have permission to edit the current page.

Steps to reproduce

  • Install gin and gin_toolbar
  • Create a user with permission to access the admin toolbar but without the permission to edit nodes
  • Create a node and view it with the aforementioned user

Proposed resolution

Don't show the link when the user doesn't have the permission to edit the current page.

Remaining tasks

Perform proper access check in gin_toolbar_preprocess_toolbar before adding the link.

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

RTBC

Version

1.0

Component

Code

Created by

πŸ‡§πŸ‡ͺBelgium seutje Antwerp

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡¬πŸ‡§United Kingdom adstokoe

    #4 Works for me! Thanks.

  • Status changed to RTBC almost 2 years ago
  • πŸ‡¬πŸ‡§United Kingdom adstokoe
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    Unfortunately, the approach with PathValidator::isValid doesn't really achieve what's needed. The permission check only looks for the permission link to any page, but that doesn't necessarily mean that the current user is allowed to edit the current entity. The rest of the patch looks ok, but the permission check needs a different approach.

  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    I have started an MR which uses the simple entity access controller to see if the user has edit permissions.

  • Status changed to Needs review over 1 year ago
  • @jurgenhaas opened merge request.
  • First commit to issue fork.
  • @elgandoz opened merge request.
  • πŸ‡¦πŸ‡ΊAustralia elgandoz Canberra

    #11: the merge was blocked by a conflict and I (unsuccessfully) tried to rebase from upstream, sorry about the mess

    #14: this is the new branch with the cherry picked commit by @jurgenhaas, with the merge fix.
    I had to change the fix given that I tried with different roles and one of them (implementer) wasn't able to see the breadcrumb despite having the permission "[CT]: Edit its own content".

    See here the differences between a moderator and a implementer:


    The issue was basically the same as this one https://www.drupal.org/project/drupal/issues/3204423 β†’ , caused by the confusion of the names between "edit" and "update" for the entity access check.
    Before: $entity->access('edit')
    After: $entity->access('update')

    Now it works nicely has expected, please review.

  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    Thanks @elgandoz for updating the MR. Unfortunately, it only applies to 1.0.x-dev but not to 1.0.0-RC3 because of this commit: https://git.drupalcode.org/project/gin_toolbar/-/commit/4e66cd7c20b249be...

    But there isn't much we can do about that.

  • πŸ‡¦πŸ‡ΊAustralia elgandoz Canberra

    Hey @jurgenhaas, I removed the commits past your one and amended it, in order to have the 'update' access check, in the original 3319445-edit-link-in branch you created, and force-pushed.
    So now the diff from MR!25 should apply on 1.0.0-RC3, while MR!30 goes on 1.0.x-dev in order to get merged.
    Please check since I didn't test it.

  • Status changed to RTBC over 1 year ago
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    Thanks @elgandoz that's a nice solution as well. So MR !25 is for the latest RC3 and MR !30 is for the dev release. This is working great.

  • πŸ‡¨πŸ‡¦Canada Liam Morland Ontario, CA πŸ‡¨πŸ‡¦

    Liam Morland β†’ made their first commit to this issue’s fork.

  • πŸ‡¨πŸ‡¦Canada Liam Morland Ontario, CA πŸ‡¨πŸ‡¦

    Rebased

  • Pipeline finished with Failed
    10 months ago
    Total: 130s
    #114995
  • Pipeline finished with Failed
    10 months ago
    Total: 130s
    #114997
  • Pipeline finished with Success
    10 months ago
    #115003
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    MR!30 didn't apply any longer and I've done a rebase. However, one part of the fix needs to be handled in Gin now, since the part of the template where this is required has moved over there.

  • Pipeline finished with Success
    6 months ago
    Total: 162s
    #199606
  • First commit to issue fork.
  • Merge request !47fix: proper access checking for urls β†’ (Open) created by hanoii
  • πŸ‡¦πŸ‡·Argentina hanoii πŸ‡¦πŸ‡·UTC-3

    hanoii β†’ changed the visibility of the branch 3319445-edit-link-in to hidden.

  • πŸ‡¦πŸ‡·Argentina hanoii πŸ‡¦πŸ‡·UTC-3

    hanoii β†’ changed the visibility of the branch 3319445-edit-link-rebased to hidden.

  • πŸ‡¦πŸ‡·Argentina hanoii πŸ‡¦πŸ‡·UTC-3

    The rebased one was missing some twig changes, I happened to worked on fixing this before having found this issue :facepalm:

    I a very similar thing and went ahead and push it, it makes it cleaner in the the twig and uses the proper drupal services.

  • Pipeline finished with Success
    6 months ago
    Total: 160s
    #204106
  • Pipeline finished with Success
    6 months ago
    Total: 192s
    #204116
  • Pipeline finished with Success
    6 months ago
    Total: 221s
    #204124
  • First commit to issue fork.
  • Pipeline finished with Success
    4 months ago
    Total: 165s
    #269567
  • πŸ‡¦πŸ‡ΊAustralia dpi Perth, Australia

    Overall proposal looks fine, however I've modified the MR to be a little more correct.

  • Pipeline finished with Success
    4 months ago
    Total: 181s
    #269569
  • Pipeline finished with Failed
    4 months ago
    Total: 313s
    #269568
  • First commit to issue fork.
  • Pipeline finished with Success
    3 months ago
    Total: 120s
    #287470
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen
Production build 0.71.5 2024