Permission for admin forms not correct

Created on 24 February 2023, almost 2 years ago

Updated 16 March 2023, almost 2 years ago

While writing automated tests I discovered an issue with access permissions.

The current permission in access_by_ref.routing.yml contains the following permission setting:

_permission: 'administer site configuration + administer access_by_ref_settings settings'

This has several problems:

The permission "administer access_by_ref_settings settings" should not have "_settings".
The permission defined in access_by_ref.permissions.yml is "administer access_by_ref settings".
There cannot be spaces around the + operator.
Even when the permission name was corrected, access was denied due to the spaces.
I'm not convinced we need "administer site configuration" is needed at all.
The administrator user has automatic access to all admin forms, so I think only administer access_by_ref settings is required.
I think "administer access_by_ref settings" should be all that's needed for the admin forms.
I also think that a lot of people don't realise "+" is the "or" operator for permissions, so its use should be avoided unless essential.

Update permissions yml file to only require "administer access_by_ref settings" permission.

Submit merge request with updated permissions file.

None

None

None

🐛 Bug report

Status

Fixed

Version

2.0

Component

Code

Created by

🇮🇪Ireland lostcarpark

Live updates comments and jobs are added and updated live.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Issue created by @lostcarpark
@lostcarpark opened merge request.
Status changed to Needs review almost 2 years ago12:00am 25 February 2023
Comment almost 2 years ago →
🇮🇪Ireland lostcarpark
Created pull request for change to fix permissions.
Comment almost 2 years ago →
🇺🇸United States ultimike Florida, USA
I think this change makes sense.

For the record, the only use of multiple permissions in a route permission that I could find in Drupal Core looks like this:

entity.workspace.collection: path: '/admin/config/workflow/workspaces' defaults: _title: 'Workspaces' _entity_list: 'workspace' requirements: _permission: 'administer workspaces+edit any workspace'
-mike
Status changed to Fixed almost 2 years ago6:38pm 16 March 2023
Comment almost 2 years ago →
🇳🇱Netherlands Marceldeb

Production build 0.71.5 2024