Contrib.social

Don't allow users to translate content they can't edit

Open on Drupal.org →
Created on 21 August 2024, 4 months ago

Problem/Motivation

If a user has the permission 'translate editable entities' but they can't edit a particular content type/node, the user still sees the "Translate" operation for that node.

Steps to reproduce

  1. Install a new Drupal site.
  2. Enable the "Content Translation" module.
  3. Go to /admin/config/regional/content-language.
  4. Enable "Content" the "Custom language settings" field.
  5. Expand "Content" and check the box beside "Article" and "Basic page".
  6. Save configuration.
  7. Go to /admin/config/regional/language.
  8. Add a new language.
  9. Create a new user with the "Content editor" role.
  10. Edit permissions for the "Content editor" role.
  11. Enable the "Create translations", "Delete translations", "Edit translations", and "Manage translations for any entity that the user can edit" permissions.
  12. Disable the "Basic page: Create new content", "Basic page: Delete own content", "Basic page: Delete revisions", "Basic page: Edit any content", and "Basic page: Edit own content" permissions.
  13. Save permissions.
  14. As an Administrator, create a published Basic page node.
  15. In an incognito window, login as the new Content editor user.
  16. Go to /admin/content.
  17. Verify you still see the "Translate" operation button.

Proposed resolution

In content_translation.module, content_translation_translate_access(), the condition added for the 'translate editable entities' permission paired with the 'update' access check of the entity can be false, but the overall condition will be true.

We need to be able to negate the condition if user has the 'translate editable entities' permission but doesn't have 'update' access for the entity. I think this can be done in a second if statement based on the current $condition variable being true.

Remaining tasks

Review issue and proposed patch.

User interface changes

None.

Introduced terminology

None.

API changes

None.

Data model changes

None.

Release notes snippet

🐛 Bug report
Status

Closed: works as designed

Version

11.0 🔥

Component
Content translation  →

Last updated 1 day ago

No maintainer
Created by

🇺🇸United States weekbeforenext Asheville, NC

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024