Access to the systemAdminMenuBlockPage is denied if it contains first other pages of this type

🐛 Admin page access denied even when access is given to child items RTBC has not yet been released. Did you test on the latest 10.3.x?

Please share code snippets.

Then set this back to “active”.

I had previously tested this on 10.2 with the patch to issue #3413508, but I tested it on the 10.3-dev branch.

I wanted to create a menu with a collection of frequently used settings for the administrator. I created a custom router with the following configuration:

test.admin:
  path: '/admin/test'
  defaults:
    _title: 'Test'
    _controller: '\Drupal\system\Controller\SystemController::systemAdminMenuBlockPage'
  requirements:
    _permission: 'access administration pages'

and added the link to the file links.menu.yml

test.admin:
  title: 'TEST'
  route_name: test.admin
  parent: nts_core.admin

test.admin.item_1:
  title: 'Item 1'
  route_name: system.admin_config_system
  # route_name: system.site_information_settings
  parent: test.admin

test.admin.item_2:
  title: 'Item 2'
  route_name: system.admin_reports
  # route_name: system.site_information_settings
  parent: test.admin

If the page contains only links to other pages that are being processed SystemController::systemAdminMenuBlockPage, 403 is displayed.

If there is 1 element that returns another page (for example, I used the system.site_information_settings route for testing), then the page is displayed well, including other links to the page.
---
If a page implemented using SystemController::systemAdminMenuBlockPage contains only links to pages that are also implemented by this controller, it is displayed as 403

This patch fixed it for me

I confirm that patch #5 has worked for me too

Patch #5 not working with Drupal 10.3.1

#5 patch does not apply to core 10.3.2

orabi → changed the visibility of the branch 3438967-access-to-the to hidden.

orabi → changed the visibility of the branch 3438967-access-to-the to active.

This fix has been included in 10.3.x so I guess this issue can me closed and assumed fixed?

Is this still a problem on a supported version of Drupal? If we don't receive additional information to help with the issue, it may be closed after three months.

I can confirm that the bug is still reproducible on version 11.0.9 and on 11-dev.
I used the steps described in #3 to reproduce it.

[Patch did not install on 10.3.10]

I am seeing this issue (or a related issue?) on 10.3.10 and 10.4.1

It shows with the regular menu structure of drupal commerce, under "configuration."

That page, configurationm gets an access denied. The subchildren in the menu do not.

In this case, the top level item for "configuration" that is blocked is of type:
_controller: '\Drupal\system\Controller\SystemController::overview'

and the child menus are
_controller: '\Drupal\system\Controller\SystemController::systemAdminMenuBlockPage'

If I replace the top level controller route with some other vanilla controllers (one of my own), then the whole hierarchy works.

Either this is a different bug, or it is the same and somehow the parents of are affected as well.