When building the list of templates for the "from template" page the 'clone [bundle] content' permission is checked directly. This skips additional access checks that might be in place leading to templates being shown that the user cannot actually clone from.
!$this->currentUser()
->hasPermission('clone ' . $bundle . ' content')
Assuming you have some content templates in place already, implement a custom access check and deny access to the 'clone' operation on nodes. Verify that templates are shown on the "from template" page but that no clone can be created from them.
Use a proper access check on the source node for the template:
!$template->get('field_source')->entity->access('clone', NULL)
- Create MR
- Review MR
- Merge MR
N/A
N/A
N/A
Active
1.2
Code
Thank you for reporting this bug. You have a good point, the check for access should be not only from one permission. I will review this MR soon.