Problem/Motivation

The Paragraphs Edit module is widely used (10k+ installations). It provides contextual menu links so that paragraphs can be edited, cloned or deleted directly from a node view page without the need to go to the node edit page.

Steps to reproduce

Install paragraphs Paragraphs Edit along with Paragraphs Clipboard. Hover the mouse over a paragraph, then click the context menu icon in top-right corner of the paragraph content. The context menu appears, showing only edit, clone and delete options - it does not include a copy to clipboard option.

Proposed resolution

Extend existing functionality so that copy to clipboard is included in the context menu.

Collaboration with Paragraphs Edit maintainers may be worthwhile to help ensure future compatibility of the integration.

  • It may make more sense for Paragraphs Edit to be extended to support Paragraphs Clipboard rather than the reverse.
  • It may be necessary or more appropriate for supporting changes to be made in both modules.

Issue fork paragraphs_clipboard-3513457

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

andy inman created an issue. See original summary.

andy inman’s picture

andy inman commented
Issue summary: View changes
hhvardan’s picture

hhvardan commented
Assigned: Unassigned » hhvardan

hhvardan opened merge request !3

hhvardan’s picture

hhvardan commented
Assigned: hhvardan » Unassigned
Status: Active » Needs review

I’ve implemented a contextual link for paragraphs that allows copying to the clipboard via an AJAX callback.
The link is injected conditionally when the Paragraphs Edit module is enabled.

andy inman’s picture

andy inman commented

Hi @Vardan Harutyunyan I’ve tested it with Drupal 10 using the https://dev-lcmd10.pantheonsite.io/ site.

Using copy-to-clipboard from the context menu works great. I tried pasting to into the same paragraph and into a different paragraph on a new node. Both ok. Check Mark

But I think there’s a potential security issue: the new route at /paragraphs-clipboard/paragraphs/{paragraph}/copy is accessible to users who would not have access to view the paragraph being copied. So maybe instead of using permission access content, you need to do an access check on the paragraph - confirm that the current user would be able to edit that paragraph. It seems that Paragraphs Edit does something like that - I haven’t looked at the code, but looked at the related URLs from the context menu, and tried accessing them as anonymous user. I’m using this test page: https://lcmd10.lndo.site/en/node/20

Edit: https://dev-lcmd10.pantheonsite.io/en/paragraphs_edit/node/20/paragraphs... → Access Denied. Check Mark

Clone: https://lcmd10.lndo.site/en/paragraphs_edit/node/20/paragraphs/4/clone?d... → Access Denied. Check Mark

Delete: https://lcmd10.lndo.site/en/paragraphs_edit/node/20/paragraphs/4/delete?... → Access Denied. Check Mark

Copy to clipboard: https://lcmd10.lndo.site/en/paragraphs-clipboard/paragraphs/4/copy?desti... → OK, returns JSON. Cross Mark

The JSON returned doesn’t seem to include any sensitive, data, but nonetheless, this behaviour doesn’t seem appropriate.

Finally, just a minor point: The Paragraph has been copied to clipboard message appears right at the top of the page, which is often not visible. It’s definitely useful to show a confirmation that the copy happened - maybe use a JS alert box instead? Or, insert at the top of the paragraph that was copied, but I imagine that would be a lot more work.

hhvardan’s picture

hhvardan commented

@Andy Inman Thanks for checking and for your helpful comment.

I updated the route to use _entity_access: 'paragraph.update' instead of 'access content'.
Now, only users who can edit the paragraph will be able to use the copy feature.

About the message: you’re right that it’s easy to miss at the top of the page, but for now, I’ll keep using the default Drupal message system.
Showing the message closer to the paragraph would be a great improvement.
Using a JS alert could work too, but it’s not the best choice for Drupal UX and accessibility.

andy inman’s picture

andy inman commented

Hi @Vardan Harutyunyan I’ve retested, as before, and confirmed that access to the AJAX callback is now suitably restricted.

About the confirmation message - I agree it makes sense to keep it simple and standard. I did some reading: https://api.drupal.org/api/drupal/core!lib!Drupal!Core!Ajax!MessageComma... - the part // A status message added an alternate location. part would be relevant - but would need a suitable location in the page. I notice that, when you click copy-to-clipboard, the Drupal AJAX spinner appears for a moment, inside the paragraph that was copied - that’s where the message could be shown. But I have no idea how you would identify that element. So, I’m sure it would be possible, but too much work for a small benefit.

andy inman’s picture

andy inman commented
Status: Needs review » Reviewed & tested by the community
hhvardan’s picture

hhvardan commented
Status: Reviewed & tested by the community » Fixed

Thannk you @Andy Inman

  • hhvardan committed 93ee0e4e on 1.0.x 
    issue #3513457: Added support for the Paragraphs Edit module

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.