The entity link label formatter should check URL access

Created on 10 September 2023, 9 months ago
Updated 9 October 2023, 8 months ago

Problem/Motivation

Hi, I'm running into a problem that the `entity_reference_label` formatter does not check the URL access to the entity, but only relies on checking the access to the 'view label' operation and I'm getting invalid links.

Steps to reproduce

This can be reproduced by displaying a link to the user. The user always returns AccessResultAllowed for the 'view label' operation, but the direct view link (the 'view' operation) requires additional permissions.

Proposed resolution

I suggest adding an additional access check to the generated URL and if it is not available, output the label as plain text.

Remaining tasks

See #9.
Code review

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Needs work

Version

11.0 🔥

Component
Entity 

Last updated about 9 hours ago

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024