- Issue created by @tedbow
- @tedbow opened merge request.
- Status changed to Needs review
12 months ago 1:38pm 6 November 2023 - Status changed to Needs work
12 months ago 2:18pm 6 November 2023
In
🐛
Restrict access to empty top level administration pages
Fixed
we were testing routes that had the _access_admin_menu_block_page access tag which gets added in \Drupal\system\EventSubscriber\AccessRouteAlterSubscriber::accessAdminMenuBlockPage for routes that use Drupal\system\Controller\SystemController::systemAdminMenuBlockPage
Unfortunately we(meaning me, sorry) used admin/people which I thought used systemAdminMenuBlockPage but looking at the route
entity.user.collection:
path: '/admin/people'
defaults:
_entity_list: 'user'
_title: 'People'
requirements:
_permission: 'administer users'
It does not use that callback.
Replace the use of admin/people with admin/reports(or another route that uses systemAdminMenuBlockPage).
Check if we are using any other routes that don't use that controller.
We can leave routes that are using \Drupal\system\Controller\SystemController::overview because that is being addressed in
📌
Restrict access to empty top level administration pages for overview controller
Fixed
Needs work
11.0 🔥