Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 301262

Access to 'Reset to alphabetical' denied for users without administer permission

$
0
0

Reset to alphabetical button is visible if users have access to edit all terms in a vocabulary, however reset route access is determined by whether the user has administer taxonomy.

This means users without administer taxonomy can see the button, but they receive access denied when clicked.

Problem (cause)

  • Reset route uses administer taxonomy permission. (See \Drupal\taxonomy\Entity\Routing\VocabularyRouteProvider::getResetPageRoute)
  • Button visibility on is determined by checking $term->access('update') on all terms. (See $change_weight_access)

Proposed solution

  1. Create a reset-all-weights operation for vocabularies.
  2. Check administer taxonomy before checking all terms.
  3. Move all existing $change_weight_access logic to operation access
  4. Change reset route permission to use _entity_access: 'vocabulary.reset-all-weights'
  5. Check vocabulary access before showing button.

Related concerns were raised in #1848686: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission)


Viewing all articles
Browse latest Browse all 301262

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>