Contrib.social

Group permissions cause AJAX to crash with 403 Forbidden

Open on Drupal.org →
Created on 10 January 2024, about 1 year ago
Updated 23 February 2024, 11 months ago

Problem/Motivation

Clean install Drupal 10.2.1 and Group 1.6/2.2.2, no patches.
Have a view listing group members with AJAX set to Yes. Group permission of the view is set to "Administer Group Members". The view shows for the users who have this permission, but AJAX-sorting of the columns e.g. Last Name of the user produces an AJAX error: 403 Forbidden. Any other AJAX-enabled function (such as pager) also crashes. The view functions and sorts as expected if AJAX is set to No OR the view permission is set to e.g. "Permission View published content" (anything, but not group permission).

Steps to reproduce

1. Create a view listing group_content: membership, call it "A TEST Ajax 403", Format: Table and add a relationship to the user entity.
2. Add fields to the view "Title", "Name" and make them sortable in the view settings
3. Set path to /group/%group/a_test_ajax_403
4. Set the view permission to "Group: View published group" (any Group permission will do)
5. Set AJAX to Yes
6. Login as a group member, who has the defined permission in 4, go to group/X/a_test_ajax_403
7. View shows, click on the column header to sort.
8. Enjoy the error

Proposed resolution

-

Remaining tasks

Provide a patch

User interface changes

None

API changes

None

Data model changes

None

🐛 Bug report
Status

Active

Version

2.2

Component

Code

Created by

🇦🇹Austria jordik

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @jordik
  • Comment about 1 year ago →
    🇦🇹Austria jordik

    Here is the error message:

    Path: /drupal10/views/ajax?_wrapper_format=drupal_ajax&view_name=a_test&view_display_id=page_1&view_args=1&view_path=%2Fgroup%2F1%2Fa_test_ajax_403&view_base_path=group%2F%25group%2Fa_test_ajax_403&view_dom_id=8f389401b820d9fcea507caac2ede0c96a4640105588e58078e48d7405ec2c0a&pager_element=0&order=label&sort=asc&_drupal_ajax=1&ajax_page_state%5Btheme%5D=olivero&ajax_page_state%5Btheme_token%5D=&ajax_page_state%5Blibraries%5D=eJxdjFEOwiAQRC8E5UhmgbGuUpYsFOT2msbU6M_kzZtkPK-XwgXOf8AEUbioe6G0UGjcYRPnh5H0RhV3BeJZMnVeqbFkWxEkR9J5jkUGFNH6aX2S8L2oIA03m0lVxr8dHGHqrA2b81RhOmNUd-RCd3r-iE3invACs1BMjA. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: in Drupal\views\Controller\ViewAjaxController->ajaxView() (line 201 of D:\xampp\htdocs\drupal10\core\modules\views\src\Controller\ViewAjaxController.php).

  • Comment 12 months ago →
    🇦🇹Austria jordik

    Not working in 2.2.2. either.

  • Comment 11 months ago →
    🇮🇳India venu_bhagirath

    facing same issue. The following patch fixed it for me.
    https://www.drupal.org/project/group/issues/2942657#comment-15285989 🐛 403 error for views.ajax route on Group related views (with AJAX enabled) Needs work

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024