Contrib.social

Permission hardening for "Schedule a status change" transition dropdown

Open on Drupal.org →
Created on 18 July 2023, over 1 year ago
Updated 5 August 2024, 3 months ago

Problem/Motivation

In the "Schedule a status change" transition dropdown, users should only see transitions for which they have "Schedule X transition" permission.

Steps to reproduce

  1. Enable Lightning Workflows and Scheduler modules
  2. Navigate to /admin/config/workflow/workflows and create a Workflow w/ states Draft, In Review, Published.
  3. Add Workflow Transitions: Create new Draft, Send to Review, Publish
  4. Select Basic Pages content type in "This Workflow Applies to" section
  5. Assign Authenticated user "Basic Page: Create new content" permission.
  6. Assign Authenticated User role "Use Create New Draft transition.". Other transition permissions should remain unchecked for the Authenticated user.
  7. Assign Authenticated user "Schedule Send to review transition.". Other permissions for "Schedule X transition" should remain unchecked for Authenticated user.
  8. As an Authenticated user , create a new Basic page.
  9. At the bottom of the Add/Edit form, click on "Schedule a status change".

RESULT: User sees "Change to" dropdown w/ values "Draft", "In review", "Published".

EXPECTED: according to set permissions user should be able to see only "In review" transition in the "Change to" dropdown.

Proposed resolution

Patch attached

Remaining tasks

User interface changes

None

API changes

None

Data model changes

None

🐛 Bug report
Status

Closed: outdated

Version

1.0

Component

Code

Created by

🇺🇸United States oksana-c

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024