"Non-reusable blocks must set an access dependency for access control."

Created on 17 April 2024, 8 months ago
Updated 6 September 2024, 4 months ago

Problem/Motivation

Under some circumstances (it's not entirely clear to me when this does or doesn't happen yet) it is possible for a translated section component to reference a different block content revision than the original language component.

The problem is Drupal\block_content\BlockContentAccessControlHandler::checkAccess() checks that the revision ID of the block content for which access is being checked is referenced by a component of the page in which the block exists. However, it only checks the components on the default revision, not the translated component configuration, so it can end up returning an AccessResult::forbidden() with the reason "Non-reusable blocks must set an access dependency for access control.".

When debugging I'm seeing the forbidden access result returned several times per page when visiting or editing the layout of pages with an affected block, but it often seems to be harmless. It is breaking ajax requests when adding media via media library though and could probably cause issues in other scenarios as well.

Steps to reproduce

  1. Ensure you have a custom block type which is translatable and has a media reference field using the media library widget in the form display settings and that this block can be added via layout builder
  2. Ensure you have a node type which allows overriding layout builder per node
  3. Find or produce an affected node. I'm not sure exactly what causes a node to be affected yet - it doesn't seem to be enough just to add a node with a layout and translate components.
  4. Edit the layout translation by editing the layout in your non-default language as normal
  5. Edit your block with a media reference
  6. Remove the current media reference
  7. Attempt to add a new media reference - you should see that it fails silently when you have selected a media and click "Insert". No error is displayed, but the dialog does not close and the media is not added.
  8. If you check your browser console you'll see an ajax error with content ""Non-reusable blocks must set an access dependency for access control."

Proposed resolution

I think this can be fixed by layout_builder_st adding it's own event subscriber extending the Drupal\layout_builder\EventSubscriber\SetInlineBlockDependency one which also checks the revision IDs in translated components. I will attach an MR for that shortly.

Remaining tasks

  1. Prepare an MR
  2. Identify more clear/reliable steps to reproduce so it's easier to test this
๐Ÿ› Bug report
Status

Needs review

Version

1.0

Component

Code

Created by

๐Ÿ‡จ๐Ÿ‡ฆCanada dylan donkersgoed London, Ontario

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024