Contrib.social

Block actual preview route access

Open on Drupal.org →
Created on 25 August 2023, 10 months ago
Updated 30 August 2023, 10 months ago

Problem/Motivation

The module just hides a form button, but the actual access to the "preview route" isn't changed.

This is probably mitigated by the fact that the preview route involves a uuid, but there's an actual access handler for this specific operation, so we should probably be altering it.

🐛 Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

🇺🇸United States gcb

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @gcb
  • Status changed to Needs review 10 months ago
  • Comment 10 months ago →
    🇺🇸United States gcb
  • Comment 10 months ago →
    System Message
    • 04dc88b7 committed on 1.x 
      Issue #3383501 by gcb: Block actual preview route access
  • Assigned to robphillips
  • Status changed to Fixed 10 months ago
  • Comment 10 months ago →
    🇺🇸United States robphillips

    Good callout! I went a different route with the implementation, however. Instead of overriding the existing access_check.node.preview service the module provides it's own access_check.node.preview_permissions service. Drupal registers every access check provider using the applies_to property. If either the access_check.node.preview or access_check.node.preview_permissions access checker returns forbidden the preview route responds with access denied. Furthermore, the new service is used to set the preview button element access.

  • Comment 10 months ago →
    System Message

    Automatically closed - issue fixed for 2 weeks with no activity.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024