The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.The 'Save as @bundle default' button is displayed for users that can edit a given node, and thus customize the content for that node, even if they don't have permissions to administer the default content for that bundle type. If a user clicks the button, the default is not saved, so it isn't a security issue (in my testing). It is confusing though to display that button. Patch forthcoming.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | panelizer-ipe-integration-fix-2199859-02.patch | 551 bytes | lorique |
Comments
Comment #1
jhedstromAdding an
#accessattribute to that button is sufficient in my testing.Comment #2
lorique commentedI tried out this patch, and sure it works but the permission is wrong. The permission used is the content permission, but what should be used for this button is the defaults permission.
I have updated the patch.
Comment #3
AndersNielsen commentedPatch in #2 solved the problem.
Comment #4
heyyo commentedWorks for me too. Would be happy to see it comitted.
Comment #5
damienmckennaI'll review this soon, but I really do appreciate all of the help working out a fix and reviewing it!
Comment #6
damienmckennaComment #8
damienmckennaCommitted. Thanks!