Block library view links to the edit page for each content block even when the user does not have edit access

Created on 19 June 2024, 5 months ago

Install Standard with HEAD.
At /admin/content/block, click "Add content block".
Create a test block.
On admin/structure/block, click the "Place block" button in the Header region, and place an instance of the test block from step 3.
At /admin/people/create, create a test user that only has the "authenticated user" role.
At /admin/people/permissions/authenticated, grant authenticated users only the "Access the Content blocks overview page" permission.
Log in as the test user.
Go to /admin/content/block.
Click on "Test block 1".
Observe the "Access denied" message, despite the content block being published? In fact, there doesn't even seem to be publishing status for the block.
Uninstall Views UI and Views.
Switch back to the test user.
Go back to /admin/content/block.
Observe that there is no link to the non-editable block, and therefore no unexpected 403.

Make the view render the link only if the user has edit access.

TBD

On admin/content/block with Views enabled, block titles no longer link to the content block edit form unless the user has edit access.

TBD

TBD

N/A

🐛 Bug report

Status

Postponed

Version

11.0 🔥

Component

Block content →

Last updated about 23 hours ago

Created by

🇺🇸United States xjm

Live updates comments and jobs are added and updated live.

Comments & Activities

Issue created by @xjm
Status changed to Postponed 5 months ago8:38pm 19 June 2024
Comment 5 months ago →
🇺🇸United States xjm
Per @larowlan ✨ Add view tab + standard template for block content Needs work would resolve this, so maybe this should be closed dupe and its STR incorporated into that issue's summary and test coverage. Postponing for now until I can take a closer look at the other.
Comment 5 months ago →
🇺🇸United States xjm
Though the thing with the entity publishing status might be a different, separate issue also.
Comment 5 months ago →
🇦🇺Australia acbramley
This may actually fix it as well without the view template 🐛 StringFormatter always displays links to entity even if the user in context does not have access Needs work

Production build 0.71.5 2024