Disable "Update" option on Extend menu

I'm not sure about this. Don't we need the update page to see what has security updates? Do we only need a warning that "using this page will not use Composer the same way Project Browser does" instead?

We want the "Available updates" page (/admin/reports/updates).

However, the "Extend->Update" page (/admin/modules/update) allows module updates to be installed in a non-Composer way, so I think it should be hidden.

Need to check how the Automatic Updates module handles module updates, and whether it replaces or modifies this page.

Shubham Garg → made their first commit to this issue’s fork.

Good work, @Shubham_kumar and @mahtab_alam. You seem to have both submitted very similar changes.

However, the "Update" should only be disabled if the "Disable add new module" config setting is selected.

I note that you've used a different hook to the way "Add new module". I may have just not found that hook. I don't mind which hook we use, but I feel we should be consistent.

I also think we should disable the route, not just the menu option, so that people can't get sent to the page another way. I implemented an event subscriber to do that for the Add New Module page.

One problem I had was getting the disabled menu option to stop showing up in Admin Toolbar, so please make sure your change works there.

Finally, I added the "DisableAddNewModuleTest" functional tests. It would be nice to see the "Update" option tested there.

Have a look at the previous change ✨ Add "Disable Add new module page" option to settings page Fixed .

Thanks for working on this!

lostcarpark → changed the visibility of the branch 3437724-disable-update-option to hidden.

lostcarpark → changed the visibility of the branch 3437724-unset-variable to hidden.

MR !508 ready for review.

I have extended the previously added functionality to disable the "Update" page, which allows modules to be updated using tar files.

I have also extended the tests to cover.

Don't do this! That route is taken over by Automatic Updates, so if you do this as-is, you'll break compatibility with that. At the very least, make sure it doesn't disable the route if Automatic Updates, or Automatic Updates Extensions, is installed.

Also, why do we bother hiding this functionality behind a config flag? IMHO we should just always disable the "add module" route anyway, since it doesn't work (modules with Composer dependencies, which is probably most of them at this point, won't function properly if they're added as ZIP files), and remove the config flag.

Okay, I see this now. I had seen that the "Automatic Updates Extensions" adds a "Update Extensions" tab, but I missed Automatic Updates changed the handling of the route.

I will look at adding a check for the Automatic Updates modules are installed.

Also, I see your point about removing the config flag. I suggest opening a separate issue to look at that.