If paragraph library items are published, then the canonical entity view pages are available to anonymous users.

e.g. /admin/content/paragraphs/5

Ideally there would be a separate permission controlling access to this route.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

malcomio created an issue. See original summary.

malcomio’s picture

Status: Active » Needs review
FileSize
1.58 KB

This patch adds a "view paragraph library item" permission

Berdir’s picture

Category: Feature request » Bug report
Status: Needs review » Needs work

I'd even say it's a bug that they're available. But lets also support the existing permissions, I'd say administer paragraphs library and also the edit permission show allow access. Per \Drupal\user\Access\PermissionAccessCheck, multiple permissions combined with "+" is an OR.

joao.ramos.costa’s picture

Following #3 I leave this small contribution, I hope it will be useful.

idebr’s picture

The `view [entity type]` permission pattern typically applies to all `view` operations in the entity access control handler. To prevent confusion I suggest we do not introduce a new permission but reuse the `edit` access check for the canonical route.

dxvargas’s picture

I agree with @idebr that using the `view` permission only for the canonical view is confusing.
I also agree, using the `edit` permission is a good suggestion.

Doing like this, we'll turn the canonical view available for editors only. I consider this an adequate solution.
Paragraph library items are meant to be used within other content and not in solo mode. If this is a requirement, a custom permission can be easily set up.

I'm submitting a new patch with this approach.

herved’s picture

I tend to agree with #5 and #6.
Patch #6 works as expected.

Tests are passing on D8.
Tests failures for D9 are also in 8.x-1.x and related to #3229472: Fix D9 test fails.

Moving this to needs review.

herved’s picture

Status: Needs work » Needs review
Berdir’s picture

Status: Needs review » Fixed

Thanks, committed. While we don't have explicit tests on not being able to access it, we have implicit tests that it still works for the existing permissions as earlier patches with a new permission failed.

  • Berdir committed c32b3d4 on 8.x-1.x authored by dxvargas
    Issue #3099016 by malcomio, joao.ramos, dxvargas: Add a permission to...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Berdir’s picture

The hardcoded permissions caused a problem for us in one project and I should have realized that sooner. Pretty sure that's what #5 actually meant. follow-up that changes the approach here: #3307481: Change library item canonical access to use the update entity access operation instead of hardcoded permissions, please test and confirm that this still works for you if you rely on this.