- Issue created by @lind101
- Merge request !37Check field edit access in the state_transition_form field formatter → (Open) created by lind101
The StateTransitionFormFormatter does not check field level access controls before displaying the transition form.
This can lead to the transition form being incorrectly diplayed to and used by Users who do not have permission to use it.
function my_module_entity_field_access($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, ?FieldItemListInterface $items = NULL) {
if ($field_definition->getName() == 'field_my_state_field' && $operation == 'edit') {
return AccessResult::forbidden();
}
return AccessResult::neutral();
}
Check edit field permissions in the StateTransitionFormFormatter (along side the existing entity access checks) and only render the form if the current user has entity and field level permission.
Active
1.12
Code