- Issue created by @lolgm
- Status changed to Needs review
4 months ago 9:54am 29 July 2024 - Merge request !3Correction of inconsistency in permissions for the “Site Manager” position. → (Open) created by lolgm
On a Drupal D10.3 I have the "Micro site", "Micro Node" and "Micro Menu" modules installed and configured.
I have a micro site created with the "test" user as "Site administrator", this way, the "test" user can manage the micro site menu as expected, but if you change the test user to "Site Manager" he will only have permissions to: go to the menu management page (/site/1/menu/site-1), create new links and move the currently present links in the menu.
After analyzing the code, I believe that this is a bug, because, in the file /src/Access/SiteMenuAccess.php on line 77, the role "Site manager" is authorized to access the menu management page.
...
if ($account->hasPermission('administer own micro menu')) {
// Site administrators and owner can always manage their menu
if ($account->id() == $site->getOwnerId() || in_array($account->id(), $site->getUsersId(SiteUsers::MICRO_SITE_ADMINISTRATOR))) {
return AccessResult::allowed()->addCacheableDependency($site)->cachePerPermissions();
}
// Site manager can manage the site menu.
if (in_array($account->id(), $site->getUsersId(SiteUsers::MICRO_SITE_MANAGER)) ) {
return AccessResult::allowed()->addCacheableDependency($site)->cachePerPermissions();
}
}
...
But in micro_menu_menu_link_content_access() in line 139 the "Site manager" position is not being allowed access to the menu_link_content.
/**
* Implements hook_entity_access().
*/
function micro_menu_menu_link_content_access(EntityInterface $entity, $operation, AccountInterface $account) {
...
// Allow the site owner and administrators to administer menu link content attached to the site menu.
if ($site instanceof SiteInterface && ($site->getOwnerId() == $account->id() || in_array($account->id(), $site->getUsersId(SiteUsers::MICRO_SITE_ADMINISTRATOR)))) {
return AccessResult::allowed()->addCacheableDependency($entity)->addCacheableDependency($site);
}
return AccessResult::neutral();
}
That being said, my proposed resolution is to add verification of the "Site manager" role in micro_menu_menu_link_content_access().
None.
None.
None.
None.
Needs review
1.0
Code