Revision operation link "Revert" is not properly checking access

Created on 20 December 2023, 6 months ago
Updated 29 January 2024, 5 months ago

Problem/Motivation

In RevisionOverviewController, hasRevertRevisionAccess method is using allowedIfHasPermission to define if user has permission to revert entity or not. Because allowedIfHasPermission is returning neutral access if permission is not granted, we should validate access a bit differently than now.

code: https://git.drupalcode.org/project/entity/-/blob/8.x-1.x/src/Controller/...

Steps to reproduce

- Create revisionable entity
- Revoke "revert all {your_entity} revisions"
- Go to revision overview and you will see "Revert" button, but expected result is to not show the button if user does not have access to action.
- If you click on the "Revert" button, 403 will be shown (as expected)

Proposed resolution

Remove "Revert" button if user does not have permission to revert revision.
Validate access by explicitly checking if hasRevertRevisionAccess returns AccessResultAllowed

Remaining tasks

User interface changes

N/A

API changes

N/A

Data model changes

N/A

πŸ› Bug report
Status

Needs review

Version

1.0

Component

Entity CRUD admin UI

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024