User Accept/Decline invitation access denied

Created on 13 October 2023, 9 months ago
Updated 18 October 2023, 8 months ago

Problem/Motivation

The ginvite.invitation.accept and ginvite.invitation.decline routes are returning 403 access denied to users managing their invitations to groups. This began after I updated ginvite from alpha1 to alpha2. In alpha1 the routes are working correctly and users can create memberships or decline successfully. In alpha2 they can not and so I've marked this as a Critical bug.

The message logged into Drupal is "Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException: in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 115 of /app/web/core/lib/Drupal/Core/Routing/AccessAwareRouter.php)."

I've compared alpha1 and alpha2 at this point. The difference in AccessAwareRouter->checkAccess() method is that alpha1 returned a Drupal\Core\Access\AccessResultAllowed and alpha2 returns a Drupal\Core\Access\AccessResultNeutral which fails the isAllowed() check throwing the Exception in the logs.

I stepped further into the AccessManager->check() method. I noticed that alpha2 is returning "access_check.group.installed_content" to the $check array while alpha1 returns a "access_check.custom" in that array. I believe this is a result in the difference in routing between the module versions.

Steps to reproduce

drupal/group 3.2.0
drupal/ginvite 4.0.0-alpha2

Invite authenticated user to a group. Invited user attempt to accept or decline invitation to group.

πŸ› Bug report
Status

Fixed

Version

4.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States ikphilip Charlotte, NC, USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024