BlockComponentRenderArray::onBuildRender() does not check block access in Preview mode

Created on 5 May 2024, 7 months ago

Updated 7 May 2024, 7 months ago

Problem/Motivation

BlockComponentRenderArray::onBuildRender() does not check access to blocks before being rendered in the Edit Layout page for a given entity in Preview mode.

That could be problematic when Block::Access() prevents access to the block for any specific reason.

It could en up in fatal errors like the one reported in 🐛 Fatal error when accessing Navigation Blocks on a minimal profile installation because of the Shortcut block Needs work , where Block access is based on the presence of a 3rd party module.

Steps to reproduce

Install Drupal 11.x using Minimal profile and install Navigation module
Try to access to Navigation Layout settings page: /admin/config/user-interface/navigation-block
500 error is thrown because Shortcut module is not available

Proposed resolution

Check for block access in BlockComponentRenderArray::onBuildRender() before rendering it.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report

Status

Closed: works as designed

Version

11.0 🔥

Component

Layout builder →

Last updated about 4 hours ago

Maintained by
🇺🇸United States @tedbow
🇺🇸United States @dyannenova
🇺🇸United States @tim.plunkett

Created by

🇪🇸Spain plopesc Valladolid

Live updates comments and jobs are added and updated live.

Merge Requests

!7919BlockComponentRenderArray::onBuildRender() does not check block access in Preview mode
Open
🇪🇸Spain plopesc
updated 7 months ago

Comments & Activities

Issue created by @plopesc
Comment 7 months ago →
🇪🇸Spain plopesc Valladolid
Merge request !7919Issue #3445369: BlockComponentRenderArray::onBuildRender() does not check block access in Preview mode → (Open) created by plopesc
Pipeline finished with Failed
7 months ago
Total: 175s
#165197
Pipeline finished with Failed
7 months ago
Total: 599s
#165199
Comment 7 months ago →
🇦🇺Australia larowlan 🇦🇺🏝.au GMT+10
I think this is because the admin needs to be able to configure the block still

So we probably need a fallback
Status changed to Closed: works as designed 7 months ago9:22pm 7 May 2024
Comment 7 months ago →
🇪🇸Spain plopesc Valladolid
You were right.

Blocks need to be accessible for administrative purposes. Block itself has to ensure the logic in build() is safe enough and not rely on blockAccess() for logic that could throw unexpected exceptions.

Thank you for your help here.

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024