Access to systemAdminMenuBlockPage is denied if it contains routes using the url attribute

Created on 5 May 2025, 26 days ago

Problem/Motivation

The current access check implemented on SystemAdminMenuBlockAccessCheck doesn't work if the configured menu item uses the attribute url.

Steps to reproduce

  1. Install the latest Drupal version.
  2. Create a module test_link and implement the following route on test_link.routing.yml:
    test_link.admin:
      path: "/admin/test-link"
      defaults:
        _controller: '\Drupal\system\Controller\SystemController::systemAdminMenuBlockPage'
        _title: "Test Link"
      requirements:
        _permission: "access content"
    
  3. Implement the following menu links on `test_link.links.menu.yml`:
    test_link.admin:
      title: "Test Link Admin"
      route_name: "test_link.admin"
      parent: system.admin_content
    
    test_link.admin.content:
      title: "Content List"
      url: "internal:/admin/content"
      description: "Content listing"
      parent: test_link.admin
    
  4. Enable the module
  5. With an admin user, access the page /admin/test-link

Proposed resolution

We need to check if the menu link doesn't have a route associated with it and implement a logic to validate the cases where the link has the url attribute.

Remaining tasks

Implement the new logic;
Implement the automated tests;

User interface changes

N/A

Introduced terminology

N/A

API changes

N/A

Data model changes

N/A

Release notes snippet

N/A

🐛 Bug report
Status

Active

Version

11.0 🔥

Component

system.module

Created by

🇧🇷Brazil hfernandes

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024