- Issue created by @wim leers
- 🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺
Actually, this is AFAICT not blocked.
Crediting @tedbow because his comments on 📌 [PP-1] Add entity access checks to routes that deal with entities Postponed have helped me craft this. 😊
This is a subset of the original scope of 📌 [PP-1] Add entity access checks to routes that deal with entities Postponed .
Currently, the access administration pages permission is hardcoded in a few places critical to loading the XB UI:
experience_builder.experience_builder:
path: '/xb/{entity_type}/{entity}'
…
requirements:
_permission: 'access administration pages'
+
experience_builder.api.layout.get:
path: '/xb/api/layout/{entity_type}/{entity}'
defaults:
_controller: 'Drupal\experience_builder\Controller\ApiLayoutController::get'
requirements:
_permission: 'access administration pages'
…
experience_builder.experience_builder to use _entity_accessexperience_builder.api.layout.get to respect entity update/field edit access of edited XB field:
_entity_access route requirement, which supports dynamic entity types
::get() method, call ::fieldAccess(operation: 'edit') — this is not available as a route requirement (plus the XB field name must first be resolved, which can kinda only happen in the controller)
access administration pages permission to the anonymous user./xb/node/1/editor, which is an article node that the anonymous user cannot access.Active
0.0
Page builder
Actually, this is AFAICT not blocked.
Crediting @tedbow because his comments on 📌 [PP-1] Add entity access checks to routes that deal with entities Postponed have helped me craft this. 😊