In #2042299: Add access callbacks for both entity types we were intelligent enough to do this for saved searches – however, we still have no entity access callbacks for search indexes or servers. While not critical (access will just be denied by any entity-generic handlers), this is of course less than ideal and should be fixed.

CommentFileSizeAuthor
#1 2150347-1--access_callbacks.patch1.17 KBdrunken monkey

Comments

drunken monkey’s picture

drunken monkey
he/him
Primary language German
Location Vienna, Austria
commented
Status: Active » Needs review
StatusFileSize
new 2150347-1--access_callbacks.patch1.17 KB

This patch adds a common access callback that just checks for the administer search_api permission.
Further questions:

  • Should we allow the view operation for all users? This will only view a link to the index and its name anyways, and in cases where it would be shown to users that might not be "secret" in any way.
  • Should we forbid update and delete access for entities with ENTITY_FIXED status?

In any case, I think we should first off just commit this version, unless someone complains in the next few days.

drunken monkey’s picture

drunken monkey
he/him
Primary language German
Location Vienna, Austria
commented
Status: Needs review » Fixed

Committed.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.