Anyone can see the page on any view modes selected

Created on 8 July 2025, 30 days ago

Problem/Motivation

Anyone can see the page (here a basic page or product page) where a password has been set with all view mode selected.

See image files.

Steps to reproduce

I installed the module on a new drupal 11 (+commerce+1language[french]).
Added a password field on a product type with all view mode selected.
Added a product enable the password protection and set a password.
Idem with a Basic page.

Results : A page that says "Protected entity" with a password field and the full content of the entity. See image files.

Thx.

🐛 Bug report
Status

Active

Version

1.1

Component

Code

Created by

🇨🇦Canada Dadaisme

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @Dadaisme
  • 🇫🇷France Grimreaper France 🇫🇷

    Hi,

    How is configured the "password_protected" entity view display of your content type and of your product type?

    If in this view mode the other fields of your content entity are shown, it is normal.

    https://www.drupal.org/docs/contributed-modules/entity-access-password/p...

  • 🇬🇧United Kingdom robcarr Perthshire, Scotland

    I'm a little confused as how to use this module, as I'm seeing exactly this problem on a D11.2 site. It's not obvious if it's a bug or unclear documentation.

  • 🇫🇷France Grimreaper France 🇫🇷

    I thought there was a link on the project page to https://www.youtube.com/watch?v=TLHlYQXmlMY

    Maybe the demo will help understand.

  • 🇬🇧United Kingdom robcarr Perthshire, Scotland

    Thank you for the video. My French isn't so good, but picked up enough from the demo (about 40 mins in) to work out how to use the module correctly on a specific entity/content type:

    1. Add a 'Password protection' field to a content type, and select how to enable ('Enable per entity password access check' seems to be most useful) and the View modes to be protected ('Default' and 'Full content' probably most common use cases)
    2. Add/enable the 'Password protected' display in 'Manage display' for content type
    3. Under 'Manage display > Full' hide/disable the 'Password protect' field in the display
    4. Under 'Manage display > Password protected' disable all fields you want protected. The Password protected display is the mode that is first shown to users (unless they have bypass permissions)

    Hopefully this answers @dadaisme's original request. It's certainly helped me to work it out. If this is seen as a reasonable explanation, perhaps we should update the documentation (readme and wiki )

Production build 0.71.5 2024