Problem/Motivation

Anyone with permission to edit nodes where an entity reference field is added to select system_tag entities, can update this field.
This module is more of a 'power user' module in a way that a user with limited knowledge can break the system tags.

Steps to reproduce

  1. Add entity_reference field targeting system_tag entities to a content type.
  2. Create a node of this type as a non-admin user.

Proposed resolution

  • Add 'Assign system tags' permission.
  • Use this permission to shield access to entity_reference fields targeting system_tag entities.

Remaining tasks

?

User interface changes

N/A

API changes

N/A

Data model changes

N/A

Comments

Stefdewa created an issue. See original summary.

stefdewa’s picture

Issue summary: View changes
StatusFileSize
new1.55 KB

Patch adds a permission 'Assign system tags' and hooks into field access to hide the field for not allowed users.

kensae’s picture

StatusFileSize
new1.44 KB

This extra permisson is very usefull indeed.
I've rewritten the patch slightly:

  • With an extra check to bring the operation into account. (check 'View system tags' on the view operation, and 'Assign system tags' on the edit operation
  • I've added the 'Assign system tags' permission to the permissions yaml
kensae’s picture

kensae’s picture

StatusFileSize
new1.45 KB

In the previous patch I forgot to specify the entity reference target type, which causes permission issues with other entity references.

lammensj’s picture

Thank you for your collaboration. I'll check as soon as I find the time :-)

lammensj’s picture

StatusFileSize
new1.18 KB
new1.44 KB

Patch looks fine, just applied some code styling.

  • lammensj committed 69257f7 on 8.x-1.x
    Issue #3229825 by kensae, lammensj, Stefdewa: Add 'Assign system tags'...
lammensj’s picture

Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.