Theme access - is this really intended?

Created on 1 September 2025, 19 days ago

Problem/Motivation

After updating to OS 13.0.0-beta1, access to installed themes is restricted by social_core Themecontroller

  public function getTheme(Request $request): array {
    // Get the theme.
    $theme = $request->attributes->get('theme');

    // If the route parameter does not contain 'socialblue'.
    if ($theme !== 'socialblue') {
      // Then the user has no access.
      throw new AccessDeniedHttpException();
    }

    // The form we need.
    $form = '\Drupal\system\Form\ThemeSettingsForm';

    // Build the theme settings form with the extracted form and theme from the
    // request.
    return $this->formBuilder->getForm($form, $theme);
  }

}

If you are using a custom theme, you can not edit it.
If you want to change settings on the admin theme, you cant do it.

Proposed resolution

Allow at least admininstrators to access all themes or add an api to allow to register more themes admistators have access too.

🐛 Bug report
Status

Active

Version

13.0

Component

Code (back-end)

Created by

🇩🇪Germany slowflyer

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @slowflyer
  • 🇳🇱Netherlands robertragas

    Hello slowflyer,

    Thanks for the report.
    We will take a look into this because as far as we know we are not trying to restrict access for our Open Source users. But likely some regression caused after we moved the theme to the distribution.

Production build 0.71.5 2024