- Issue created by @tedbow
- πΊπΈUnited States tedbow Ithaca, NY, USA
Leaving assigned to myself. See not in summary
NOT DONE WITH SUMMARY PLEASE LET ME FINISH BEFORE ISSUE IS WORKED ON ETC(πtedbow)
Will finish later today, there are few steps I want to explain. Then I will bring over changes from π [PP-1] Add entity access checks to routes that deal with entities Postponed to start the MR
- πΊπΈUnited States tedbow Ithaca, NY, USA
Update the summary, not need to start the MR from the work on π [PP-1] Add entity access checks to routes that deal with entities Postponed
- πΊπΈUnited States tedbow Ithaca, NY, USA
Ok. I am guessing the change will make
entity-form-field-types-test.cy.js
fail for the field field_xbt_comment see https://git.drupalcode.org/project/experience_builder/-/merge_requests/9...Not sure it if is related but I did see problem with field_xbt_comment in π Radio button boolean fields can sometimes can be set in page data form Active
- π§πͺBelgium wim leers Ghent π§πͺπͺπΊ
What's next here? The status is not clear.
This sounds like a beta blocker given the security implications?
- πͺπΈSpain penyaskito Seville π, Spain πͺπΈ, UTC+2 πͺπΊ
Basically, if I got this right, this is the same than π Add field and entity access check on `ApiAutoSaveController::post()` Active with
`ApiLayoutController`
.The difference is that for publishing, we want to throw an
AccessDeniedException
if we don't have access to the field.For the layout, we just want to ignore the field, to prevent losing the changes other user would have made. As anyone publishing this would require to have all the needed permissions, they should be able to validate all field changes.
@Ted, can you confirm I'm right, and what's missing from the MR? (I think it is ready for review?)
- πΊπΈUnited States mglaman WI, USA
Per #10, let's postpone this on π Page status changes from "Published" to "Changed" even when no actual changes are made Active . Chatted w/ @tedbow and the conclusion was to postpone since both touch buildPreviewRenderable, then reopen to test.