Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Currently, the "administer {homebox_type} preset" permission is not used for the routing.yml preset routes. Instead, all preset routes in the routing.yml are using "administer homebox types".
Furthermore, it seems that the "HomeboxTypeAccessControlHandler" is missing quite a few operations to access check for. And some of them, like the "entity.homebox.set_default_preset" seems to be implemented in both the "HomeboxTypeAccessControlHandler" and in the routing.yml. Here the routing.yml implementation seems to be favored, which uses the incorrect "administer homebox types" permission.
Steps to reproduce
Proposed resolution
Adjust both the HomeboxTypeAccessControlHandler and the routing.yml to define the right access control without defining duplicate entries.
Remaining tasks
User interface changes
API changes
Data model changes
Issue fork homebox-3439368
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
grevil commentedComment #3
grevil commentedNote, that this currently doesn't have any major security implications.
Comment #4
anybodyLet's also fix this now. Minor as of #3
Comment #6
grevil commentedAlmost finished, will finalize it tomorrow, test fails.
Comment #7
grevil commentedDone! All tests should be green now! :)
Comment #8
anybodyWell done, LGTM!
Comment #9
anybody