I got 'Access denied for entity.' message when I make /router/translate-path?path=/my_webform request. This because the module is checking for $entity->access('view', NULL, TRUE). But for webform entity I must give some administer permissions to anonymous for entity access permission: https://www.drupal.org/project/webform/issues/2956771 .
I suggest that checking view access should be done only for entities which is instance of ContentEntityType. For webform entities I get webform uuid and rest link like /jsonapi/webform/webform/[UUID] and this link got 403 error. So /router/translate-path?path=/my_webform don't send any unrestricted access data but frontend don't have 403 error.
We can make a variant with a configuration form in which to specify a list of entities for which you do not check view access.
Now the module returns error 403 for links to web forms for anonymous users, although in fact anonymous users have access to web forms. This situation breaks the frontend system, so I consider this a module error.
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | decoupled_router-fix_webform_trans_path-3090119-11.patch | 1.75 KB | z3cka |
| #10 | decoupled_router-fix_webform_trans_path-3090119-10.patch | 1.75 KB | z3cka |
| #5 | decoupled_router-3090119-5.patch | 1.75 KB | goodboy |
Issue fork decoupled_router-3090119
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
goodboy commentedComment #3
goodboy commentedComment #4
goodboy commentedComment #5
goodboy commentedComment #6
goodboy commentedComment #9
z3cka commentedI made a MR from the patch from #5 but adapted it for the `2.x` branch: https://git.drupalcode.org/project/decoupled_router/-/merge_requests/2
I tested this with Drupal 9.2.3. Please have a look.
Comment #10
z3cka commentedand for those that like patches
Comment #11
z3cka commentedAnd here's a patch for the current version `2.0.2`, as that's what I'm using right now.
Comment #14
e0ipsoThanks for contributing! Sorry it took this long.