Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 298406

LatestRevisionCheck should assume that if a user can edit an entity, they should have access to the latest-version route

$
0
0

Problem/Motivation

I'm using content moderation in combination with the group.module, so I'm relying on node grants from that for edit access and normal editors do not have "view any unpublished entity".

As a result, /latest works fine for content that the user himself creates as he does have view own unpublished, but it doesn't work for entities that someone else created.

However, the editor can edit that entity and I'm also allowed to view it through /revisions. And on save, he's even redirect to /latest and then sees the access denied page.

Proposed resolution

Not sure what to do, For similar problems with translations, we're handling it through #2972308: Allow users to translate content they can edit, so the access check could look at edit permission, alternatively, we could add an entity type specific check through the handler, so that node can check its access revisions permissions?

Remaining tasks

User interface changes

API changes

Data model changes


Viewing all articles
Browse latest Browse all 298406

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>