Clarify "Access By Reference" permission description

Created on 4 April 2023, over 1 year ago
Updated 24 April 2023, over 1 year ago

Problem/Motivation

Allow users to edit a node if authorized by reference. is the current description of the "Access By Reference" permission.

But what you configure isn't only "edit", but also "view" or "delete" permisions. So this seems to be confusing?

I don't really get yet, what the permission does and what's the effect on users with or without the permission. Could that be clarified perhaps by someone who knows in detail and updated in code (permissions.yml)?

Marking this as "Bug report" as I think it's wrong? Not only a support question?
Thanks a lot in advance!

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Fixed

Version

3.0

Component

Documentation

Created by

🇩🇪Germany Anybody Porta Westfalica

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @Anybody
  • 🇩🇪Germany Anybody Porta Westfalica

    First code snippet to make this a bit clearer is the following behavior:

    function access_by_ref_node_access(NodeInterface $node, $op, AccountInterface $account) {
    
        // Perform basic access checks
        if(
            !isset($account) || $op == 'create' || $account->id() == 0 || !isset($node) || !$account->hasPermission('access node by reference')
        ) {
            return AccessResult::neutral();
        }
    

    So as it seems, if the permission "access node by reference" is not set, the module always returns AccessResult::neutral();!

  • Status changed to Needs review over 1 year ago
  • 🇩🇪Germany Anybody Porta Westfalica

    Here's my suggestion:

    Permission name: "Apply Access by Reference"
    Description: "Applies the access by reference rules for the selected roles. If unchecked, the permissions will not be affected in any way (neutral)"

    This should clarify things.

  • 🇩🇪Germany Anybody Porta Westfalica

    I'd even vote to rename the technical name "access node by reference" to something like "check node access by reference", but that's more complicated and should be discussed first.

  • 🇩🇪Germany Anybody Porta Westfalica

    Implemented #3 as MR!

  • @anybody opened merge request.
  • 🇳🇱Netherlands Marceldeb

    Thanks, this makes it clearer for those that did not read this in the readme ;-)

    In each case, the rule only applies to logged-in users with general permission
    to access nodes by reference, and only on the node types and field names set in
    the configuration page.

    Merged in 3.x.x dev

  • Status changed to Fixed over 1 year ago
  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024