The send for all affiliates field is available for any user

Created on 29 November 2024, 4 months ago

Problem/Motivation

When a user with an assigned domain an without "Administer Menu items across Domains" permission create or edit a menu item, the "Send for all affiliates" is available without restriction.

Steps to reproduce

- Create a user with an assigned domain and without "Administer Menu items across Domains" permission
- Add a menu link
- The "Send for all affiliates" field is available

Proposed resolution

Add an access check on module permission in domain_menu_access_form_menu_link_content_form_alter :

$form[DomainAccessManagerInterface::DOMAIN_ACCESS_ALL_FIELD]['#access'] = \Drupal::currentUser()->hasPermission('administer menu items across domains');
🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @guenole
  • Status changed to Needs work about 9 hours ago
  • 🇧🇪Belgium tim-diels Belgium 🇧🇪

    I'd like to see a failing test for this so we can make sure the provided fix will stay fixed.

Production build 0.71.5 2024