Steps to reproduce:

Drupal 8

As Admin user

  • Install Drupal 8 Using the Standard profile
  • Enable "Forum" module
  • Create "Test" user with "Authenticated" role

As anonymous user

  • Navigate to /forum
  • There is a button that says "+" is clickable and sends you to the home page
  • Next to that is a "Log in" link that takes you to the login page

D8Anonymous

As Test user

  • Login as "Test" user
  • Navigate to /forum
  • There is a button that says "+ You are not allowed to post new content in the forum" is clickable and sends you to the home page

D8Authenticated

Drupal 7

As Admin user

  • Install Drupal 7 Using the Standard profile
  • Enable "Forum" module
  • Create "Test" user with "Authenticated" role

As anonymous user

  • Navigate to /forum
  • There is a "+" next to a "Log in" link that takes you to the login page

D7Anonymous

As Test user

  • Login as "Test" user
  • Navigate to /forum
  • There is no button. Just text as expected.

D7Authenticated

One other note is that the text diplayed to anonymous users has the class "action-links", so it's indented etc.
D7ClassActionLinks

CommentFileSizeAuthor
#57 forum-links-fooey-1853072.57.patch9.07 KBlarowlan
#57 interdiff.txt1017 byteslarowlan
#53 forum-links-fooey-1853072.53.patch8.08 KBlarowlan
#51 forum-links-fooey-1853072.51.patch108.79 KBlarowlan
#51 interdiff.txt1.28 KBlarowlan
#49 forum-links-fooey-1853072.49.patch8.15 KBlarowlan
#46 forum-links-fooey-1853072.46.patch8.15 KBstefank
#34 Screen Shot 2014-10-03 at 10.39.12 PM.png19.38 KBmgifford
#33 Screenshot 2014-10-04 09.09.42.png21.22 KBlarowlan
#33 Screenshot 2014-10-04 09.09.30.png14.51 KBlarowlan
#32 forum-links-fooey-1853072.1.patch8.95 KBlarowlan
#18 forum_access_messages-1853072-18.patch19.91 KBAnonymous (not verified)
#17 forum_access_messages-1853072-17.patch19.94 KBAnonymous (not verified)
#16 forum_access_messages-1853072-16.patch15.31 KBAnonymous (not verified)
#14 forum_access_messages-1853072-14-953214-54.patch13.68 KBAnonymous (not verified)
#13 forum-messages-block-admin.png36.24 KBAnonymous (not verified)
#13 forum-no-message.png14.91 KBAnonymous (not verified)
#13 forum-login.png21.65 KBAnonymous (not verified)
#13 forum-login-register.png23.3 KBAnonymous (not verified)
#13 forum-add-new.png19.26 KBAnonymous (not verified)
#13 forum-you-are-not-allowed.png23.28 KBAnonymous (not verified)
#13 forum_access_messages-1853072-13-953214-54.patch13.68 KBAnonymous (not verified)
#13 forum-add-new-general-discussion.png21.24 KBAnonymous (not verified)
#10 forum-login-register-post.png27.94 KBAnonymous (not verified)
#10 forum-login-post.png26.01 KBAnonymous (not verified)
#10 forum_access_messages-1853072-10-953214-52.patch10.33 KBAnonymous (not verified)
#10 forum_access_messages-1853072-10-953214-52-inter-diff.txt5.56 KBAnonymous (not verified)
#7 D8-Forum-Anonymous-no-access-link.png16.54 KBAnonymous (not verified)
#7 D8-Forum-Authenticated-no-access-message.png13.87 KBAnonymous (not verified)
#6 forum-move-access-error-into-template-1853072-6.patch4.09 KBAnonymous (not verified)
#4 forum-move-access-error-into-template-1853072-4.patch4.26 KBAnonymous (not verified)
D7ClassActionLinks.png35.21 KBbjlewis2
D7Authenticated.png13.19 KBbjlewis2
D7Anonymous.png12.81 KBbjlewis2
D8Authenticated.png13.96 KBbjlewis2
D8Anonymous.png13.68 KBbjlewis2

Comments

xjm’s picture

Issue tags: +Novice

Thanks @bjlewis2!

So probably these messages should simply not be displayed inside the actions link markup. We can't backport anything here because it would be a UI change, but the only real oddities are in D8 in any case.

This might also have been affected by #1167350: Action links were ignored .

droplet’s picture

Status: Active » Postponed

I've attached a patch to #1167350: Action links were ignored , it will fix this problem

sun’s picture

Status: Postponed » Active

Unpostponing, since the markup being output here seems to be improper usage of action links.

We probably need to move those "messages"/notices into the page markup.

Anonymous’s picture

Status: Active » Needs review
StatusFileSize
new4.26 KB

I picked this up from http://core.drupalofficehours.org/task/1238 and have made a first attempt. This simply moves the access checking into the template. I have no idea if this is the best/correct/etc. way of doing it so welcome reviews!

droplet’s picture

Action links broken the UI pattern because it's called "Action link" only. I still think display the text is needed in this case.

Patch seems need more better access handle.

Anonymous’s picture

Here's another version which turns the "Log in" into an action (and fixes the link code) so only moves the not authorised message to the template.

Anonymous’s picture

@xjm in core office hours recommended I post screenshots and code snippets, so here we go. This is for the patch in #6 which is a more sensible patch than #4:

Anonymous, no access

D8-Forum-Anonymous-no-access-link.png

<h1 class="title" id="page-title">Forums</h1>
<div class="tabs"></div>
  <ul class="action-links">
    <li><a href="/user/login?destination=forum" class="button add">Log in to post new content in the forum.</a></li>
  </ul>
<div  class="region region-content">...

Authenticated, no access

D8-Forum-Authenticated-no-access-message.png

<div class="content">
  <div id="forum">
    You are not allowed to post new content in the forum.
    <table id="forum-0">
    <thead>
      <tr>...

Posting this makes me realise there's no markup on the error message, however I'm presuming all this still needs changing to twig at some point?

carsonblack’s picture

Status: Needs review » Reviewed & tested by the community

I applied the patch in #6, created the Test user and tested as anonymous as well as logged in as the Test user and the results were the same as indicated in #7.

carsonblack’s picture

Note: Applying this patch causes the patch in http://drupal.org/node/953214#comment-6693922 to not apply.

Anonymous’s picture

Status: Reviewed & tested by the community » Needs review
StatusFileSize
new5.56 KB
new10.33 KB
new26.01 KB
new27.94 KB

I've taken a first go at merging patches #1853072-6: Remove forum_menu_local_tasks_alter() hack and instead add links in ForumController::build and #953214-50: 'Login to post new content in the forum' button assumes auth users have permission to post. I've attached an interdiff file but first time created one so not sure if it worked ok.

If authenticated user has access to post new forum content and visitors can register on the site the action button now redirects to /user and looks like this:
forum-login-register-post.png

...and if Administrator only registrations then it redirects to /user/login and looks like this:
forum-login-post.png

The buttons are still somewhat confusing as you could have comments on forum topics where you can post, this just checks for posting of topics.

Status: Needs review » Needs work

The last submitted patch, forum_access_messages-1853072-10-953214-52.patch, failed testing.

sun’s picture

Issue tags: -Novice

The result of the discussion in #1167350: Action links were ignored was that Forum module should not use hook_menu_local_tasks_alter() to expose/show these links in the first place, because these are not action links.

So what we want to do here is to move that code to an entirely different spot, but essentially try to retain the approximate position.

The most simple approach would be to move the code into an own helper function (i.e., renaming the current hook implementation function), make it accept a $build render array, and make it add a container that contains the respective link or markup, depending on the configuration settings, and apply a very low negative weight to the container. (i.e., essentially doing what the current action links are doing, just without action links.)

function forum_login_box(&$build) {
  $build['forum_login'] = array(
    '#type' => 'container',
    '#weight' => -100,
  );
  $build['forum_login']['link'] = array(
    '#type' => 'link',
    '#title' => t('Log in or register to post new content in the forum'),
    '#href' => 'user',
    '#options' => drupal_get_destination(),
  );
}

Then, inject calls to this helper method from every forum page callback that needs it.

That would be the most simple way. However, I want to amend that this messaging is not really part of the actual page callback content (which is probably more or less the reason for why it has been moved into hook_menu_local_tasks_alter()).

Therefore, an alternative approach would be to turn this container into a real and new block, which just outputs the necessary link/content, and make forum_install() enable and position that block into the 'content' region with a low weight. As a result, site builders and themers will be able to move this messaging block very easily to a different place/region (e.g., into a sidebar).

Overall, the block approach would make more sense to me.

Anonymous’s picture

@sun thanks for the info, I've had a go at moving it into a block, patch attached with code from #953214-50: 'Login to post new content in the forum' button assumes auth users have permission to post as it uses a function

Block as it appears in block admin after installing forum module:

forum-messages-block-admin.png

Block content when not logged in and auth user does not have permission to post:

forum-no-message.png

Block content when not logged in, auth user can post, admin-only registration:

forum-login.png

<div id="block-forum-messages-block"  class="block block-forum" role="navigation">
  <div class="content">
    <a href="/user/login?destination=forum">Log in</a> to post new content in the forum.
  </div>
</div>

Block content when not logged in, auth user can post, visitors can register:

forum-login-register.png

<div id="block-forum-messages-block"  class="block block-forum" role="navigation">
  <div class="content">
    <a href="/user/login?destination=forum">Log in</a> or <a href="/user/register?destination=forum">register</a> to post new content in the forum.
  </div>
</div>

Block content when have permission to post:

forum-add-new.png

<div id="block-forum-messages-block"  class="block block-forum" role="navigation">
  <div class="content">
    <a href="/node/add/forum/0">Add new Forum topic</a>
  </div>
</div>

Block content when have permission to post, with redirect to forum being viewed:

forum-add-new-general-discussion.png

<div id="block-forum-messages-block"  class="block block-forum" role="navigation">
  <div class="content">
    <a href="/node/add/forum/1">Add new Forum topic</a>
  </div>
</div>

Block content when logged in and no permission to post:

forum-you-are-not-allowed.png

<div id="block-forum-messages-block"  class="block block-forum" role="navigation">
  <div class="content">
    You are not allowed to post new content in the forum.
  </div>
</div>
Anonymous’s picture

Status: Needs work » Needs review
StatusFileSize
new13.68 KB

Fixing white space issues in patch and status change to needs review

Status: Needs review » Needs work

The last submitted patch, forum_access_messages-1853072-14-953214-54.patch, failed testing.

Anonymous’s picture

Status: Needs work » Needs review
StatusFileSize
new15.31 KB

Had introduced dependency on block module which also affected other tests. Re-trying.

Anonymous’s picture

StatusFileSize
new19.94 KB

Missed a file. I'll get the grip of this soon, many appo logies ;)

Anonymous’s picture

StatusFileSize
new19.91 KB

So *that's* why I see those "Fixing new line issue" posts.

larowlan’s picture

Not sure I like the block approach, not sure why though.
I think it has to do with making block a dependency for forum, but I can't put my finger on it.

Anonymous’s picture

I totally agree, I was just following orders ;)

Do you have any alternative suggestions? I know what mine would be, but guess we'd better keep forum for the moment :D

larowlan’s picture

Well, my longer term goal would be a header area in a view, but we need some other things resolved before we can do that eg #1867642: Expose forum tables to views.
But I am struggling to come up with something that doesn't feel wrong, after re-reading sun's comments I guess block is the way to go, given most other content is moving to a block (eg site name etc).

Anonymous’s picture

Me too which is why I just did the patch, sounds like best idea is to leave it for a while to see how other things develop. If you want me to look at anything in particular feel free to use my contact form or mail steve@purkiss.com and I'll take a look, quite enjoyed getting my teeth into this even though it did give me a little bit of a shock when I realised it broke lots of tests due to the block dependency - all good learning though!

Anonymous’s picture

Someone just mentioned on twitter to me that forums should be entities - done a bit of searching but didn't find anything - is this in the planning at all? Would it be worth creating a new issue? Saw it discussed on Advanced Forum but not for Forum.

sun’s picture

@stevepurkiss: Forum containers + forums are taxonomy vocabularies, forum posts are nodes. Both vocabularies and nodes are entities in D8, so that's done already. However, that's off-topic here. :)

Anonymous’s picture

@sun ok cool thanks - just trying to get my head around future developments as it seems (I may be wrong) that I did a lot of work that won't actually be used, so just want to make sure I spend my "spare" time wisely!

thanks,

chintan.vyas’s picture

chintan.vyas’s picture

Status: Needs review » Needs work

The last submitted patch, forum_access_messages-1853072-18.patch, failed testing.

mgifford’s picture

Yup, this patch fails to apply in many, many ways right now. It will have to be re-built if the problem still exists.

mgifford’s picture

Issue summary: View changes

Added images inline

mgifford’s picture

Issue tags: +Needs reroll

Pretty much everything seems to have changed since the last roll a year ago in #18.

larowlan’s picture

Title: Unauthorized users see extra buttons on /forum » Remove forum_menu_local_tasks_alter() hack and instead add links in ForumController::build
Assigned: Unassigned » larowlan
Priority: Normal » Major

This blocks #2347465: Convert all instances of #type link/links to convert to use routes - over there they're just going to remove the hook and uncomment the tests - so we need to reinstate that functionality here.
Bumping accordingly

larowlan’s picture

Status: Needs work » Needs review
Issue tags: -Needs reroll
StatusFileSize
new8.95 KB
larowlan’s picture

mgifford’s picture

Status: Needs review » Reviewed & tested by the community
StatusFileSize
new19.38 KB

Logged in as the test user looking at the forum without ability to post it as per the description in the summary:

screenshot

I think this is ready to go. Got it up and running here for the next 5 hrs http://sb1cc35baa618c1d.s3.simplytest.me/

The code looks good to me.

dawehner’s picture

Can someone explain why we cannot solve the bug as part of forum_menu_local_tasks_alter()?

dawehner’s picture

+++ b/core/modules/forum/src/Controller/ForumController.php
@@ -49,21 +74,39 @@ class ForumController extends ControllerBase {
+      $entity_manager->getAccessControlHandler('node'),
+      $entity_manager->getFieldMap(),
+      $entity_manager->getStorage('node_type')

Please try to not do this as part of the constructor?

mgifford’s picture

Status: Reviewed & tested by the community » Needs work
larowlan’s picture

35 because they're abusing it to show text in the header in the case if the unauthorized user, ie local action with no link.
36 that is in the factory

mgifford’s picture

Status: Needs work » Reviewed & tested by the community
dawehner’s picture

Status: Reviewed & tested by the community » Needs work

36 that is in the factory

Well, this is not about "the constructor" but about the construction of objects. Executing anything there opens potentially a lot of race conditions, circular dependencies, slow code paths etc.

larowlan’s picture

Can you elaborate what you mean? This constructor signature makes it explicit what the dependencies are. The alternative is to inject the whole entity manager but that obscures the real dependencies and would mean we'd have to mock a load of methods on the entity manager if we ever wanted to add unit tests.

larowlan’s picture

Fwiw I've had several patches elsewhere that inject the entity manager knocked back in favor of this level of explicitness so assume there is no policy, instead its more of a reviewer preference thing?

dawehner’s picture

Status: Needs work » Reviewed & tested by the community

It's okay here, not okay in services.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 32: forum-links-fooey-1853072.1.patch, failed testing.

stefank’s picture

StatusFileSize
new8.15 KB

Here is rerolled patch from #32, as it doesn't apply anymore.

stefank’s picture

Status: Needs work » Needs review

Triggering testbot.

Status: Needs review » Needs work

The last submitted patch, 46: forum-links-fooey-1853072.46.patch, failed testing.

larowlan’s picture

Status: Needs work » Needs review
StatusFileSize
new8.15 KB

re-roll

Status: Needs review » Needs work

The last submitted patch, 49: forum-links-fooey-1853072.49.patch, failed testing.

larowlan’s picture

Status: Needs work » Needs review
StatusFileSize
new1.28 KB
new108.79 KB
tim.plunkett’s picture

+++ b/core/lib/Drupal/Core/Utility/Token.php
@@ -37,7 +37,7 @@
- * $node = Node::load(1);
+ * $node = node_load(1);

Base rebase?

larowlan’s picture

StatusFileSize
new8.08 KB

re-rolled without that hunk

mgifford’s picture

Status: Needs review » Reviewed & tested by the community

Looks good to me. I went through and tested this patch in SimplyTest.me.

Screenshot still looks like #34.

alexpott’s picture

Status: Reviewed & tested by the community » Needs work
Issue tags: +Needs tests

This looks like a testable bug.

tim.plunkett’s picture

Grep for 1853072 in HEAD, you'll see that there IS test coverage, we just removed it temporarily.
This issue should restore that.

larowlan’s picture

Status: Needs work » Needs review
StatusFileSize
new1017 bytes
new9.07 KB

thanks @timplunkett - restored test

tim.plunkett’s picture

Status: Needs review » Reviewed & tested by the community
Issue tags: -Needs tests
alexpott’s picture

Status: Reviewed & tested by the community » Fixed

Can we get a followup to add a test for the anonymous case - i.e. to check that the anonymous user has a link to login.

This issue addresses a major bug and is allowed per https://www.drupal.org/core/beta-changes. Committed bfe4403 and pushed to 8.0.x. Thanks!

  • alexpott committed bfe4403 on 8.0.x
    Issue #1853072 by stevepurkiss, larowlan, bjlewis2, mgifford, stefank:...
larowlan’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.