[Experimental Toolbar] Links are displayed without checking route access

Created on 8 July 2025, 6 days ago

Problem/Motivation

When the new experimental toolbar is configured, links are displayed without checking if the current user has access to the underlying route. This leads to users seeing links for actions they are not permitted to perform.

Steps to reproduce

  1. Enable the experimental Toolbar module.
  2. Create a new user role with restricted permissions. For example, a "Content Editor" role.
  3. Grant this role permission to create one specific content type (e.g., "Article").
  4. Ensure the role does not have permission to create another content type (e.g., "Basic Page").
  5. Create a user and assign them this new role.
  6. Log in as the new user.
  7. Observe the toolbar. The link to create a "Basic Page" is visible, even though the role does not have permission to do so. Clicking the link will likely result in an "Access Denied" page.

Proposed resolution

Perform an access check on the URL/route for each link before it is rendered in the toolbar. Links should only be displayed if the current user has the necessary permissions.

📌 Task
Status

Active

Version

4.1

Component

Code

Created by

🇪🇸Spain aarnau

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @aarnau
  • 🇩🇪Germany jurgenhaas Gottmadingen

    Is this about the toolbar module in core? If so, that's deprecated and will be removed soon.

    Beyond that, I'm not sure this is a theme issue. Gin doesn't provide the content, it styles the available content. So, if there's a link that's provided by a module that shouldn't be there, the issue should probably reported there. Or am I missing something?

  • Merge request !634Resolve #3534651 "Experimental toolbar links" → (Open) created by aarnau
  • Pipeline finished with Success
    6 days ago
    Total: 163s
    #541781
  • 🇪🇸Spain aarnau

    Thanks for the quick reply and for the clarification.

    To confirm, this issue occurs when using the Gin Admin Theme and its associated "Gin Toolbar". I am not using the deprecated core "Toolbar" module.

    You are right that themes usually only style content. However, I can confirm the problem is specific to Gin because it only appears when the Gin Toolbar is enabled. When I switch back to the default Drupal toolbar (from the core "Toolbar" module, for testing purposes), the access checks work correctly and the inaccessible links do not appear.

    Based on this, I investigated further and located the source of the problem in the `GinNavigation.php` class. To help resolve this, I have created a Merge Request with a proposed fix.

    You can review the changes here: https://git.drupalcode.org/project/gin/-/merge_requests/634/diffs

    Please let me know if you have any feedback on the solution. Thanks again for your help!

  • 🇩🇪Germany jurgenhaas Gottmadingen

    Maybe some clarification required:

    When you're on Gin version 4 together with Gin Toolbar 2, this is also using the toolbar module from core as that's declared as a dependency. Only in Drupal core 11.2 together with Gin 5 and Gin Toolbar 3, the core toolbar is no longer required. Instead, the navigation module from core is taking over both the left and the top toolbar.

    What we have in Gin 4 is an experimental implementation of that navigation, which is no redundant as navigation module in core has matured, and Gin will remove its experimental implementation as a result of that.

Production build 0.71.5 2024