Access to the systemAdminMenuBlockPage is denied if it contains first other pages of this type

Created on 5 April 2024, 9 months ago

Steps to reproduce

- Create a route that handles \Drupal\system\Controller\SystemController::systemAdminMenuBlockPage
- Add links to this page in the file *.links.menu.yml (The links should lead to the page that is handled by the same controller, for example, add a link to the system.admin_reports route. Must be set to 1 item in the list)
- Go to the created page
- Page 403 is displayed ()

πŸ› Bug report
Status

Active

Version

10.3 ✨

Component
SystemΒ  β†’

Last updated 3 days ago

No maintainer
Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @maks oleksyuk
  • Status changed to Postponed: needs info 9 months ago
  • πŸ› Admin page access denied even when access is given to child items RTBC has not yet been released. Did you test on the latest 10.3.x?

    Please share code snippets.

    Then set this back to β€œactive”.

  • Status changed to Active 9 months ago
  • I had previously tested this on 10.2 with the patch to issue #3413508, but I tested it on the 10.3-dev branch.

    I wanted to create a menu with a collection of frequently used settings for the administrator. I created a custom router with the following configuration:

    test.admin:
      path: '/admin/test'
      defaults:
        _title: 'Test'
        _controller: '\Drupal\system\Controller\SystemController::systemAdminMenuBlockPage'
      requirements:
        _permission: 'access administration pages'
    

    and added the link to the file links.menu.yml

    test.admin:
      title: 'TEST'
      route_name: test.admin
      parent: nts_core.admin
    
    test.admin.item_1:
      title: 'Item 1'
      route_name: system.admin_config_system
      # route_name: system.site_information_settings
      parent: test.admin
    
    test.admin.item_2:
      title: 'Item 2'
      route_name: system.admin_reports
      # route_name: system.site_information_settings
      parent: test.admin
    

    If the page contains only links to other pages that are being processed SystemController::systemAdminMenuBlockPage, 403 is displayed.

    If there is 1 element that returns another page (for example, I used the system.site_information_settings route for testing), then the page is displayed well, including other links to the page.
    ---
    If a page implemented using SystemController::systemAdminMenuBlockPage contains only links to pages that are also implemented by this controller, it is displayed as 403

  • First commit to issue fork.
  • πŸ‡§πŸ‡ͺBelgium mikell

    This patch fixed it for me

  • πŸ‡¬πŸ‡·Greece zorz

    I confirm that patch #5 has worked for me too

  • πŸ‡¨πŸ‡­Switzerland cola

    Patch #5 not working with Drupal 10.3.1

  • πŸ‡¦πŸ‡ΊAustralia gigimaor Narangba/Brisbane

    #5 patch does not apply to core 10.3.2

  • πŸ‡§πŸ‡ͺBelgium Orabi Gent

    orabi β†’ changed the visibility of the branch 3438967-access-to-the to hidden.

  • πŸ‡§πŸ‡ͺBelgium Orabi Gent

    orabi β†’ changed the visibility of the branch 3438967-access-to-the to active.

  • πŸ‡§πŸ‡ͺBelgium Jonasanne

    This fix has been included in 10.3.x so I guess this issue can me closed and assumed fixed?

  • πŸ‡³πŸ‡ΏNew Zealand quietone

    Is this still a problem on a supported version of Drupal? If we don't receive additional information to help with the issue, it may be closed after three months.

  • I can confirm that the bug is still reproducible on version 11.0.9 and on 11-dev.
    I used the steps described in #3 to reproduce it.

Production build 0.71.5 2024