Problem/Motivation

On a fresh installation of Drupal 8, go to admin/structure/block/demo/seven as an unprivileged/anonymous user. The "access denied" page you get to is shown in the Seven theme, rather than Bartik.

This is incorrect since the unprivileged user does not have permission to see the administrative theme. The access denied page should be shown to them in Bartik, like on other admin pages.

Proposed resolution

Add a permission check to AdminDemoNegotiator.

Remaining tasks

Needs review.

User interface changes

The theme specified in the route is no longer shown to unprivileged users.

API changes

The current user is passed to the theme negotiator.

Data model changes

None.

CommentFileSizeAuthor
#27 2491627-after_patch.png26.15 KBabhijith s
#27 2491627-before_patch.png16.74 KBabhijith s
#25 3068698-after_patch.png9.9 KBabhijith s
#25 3068698-before_patch.png7.45 KBabhijith s
#23 interdiff_2491627_7-23.txt1.15 KBankithashetty
#23 2491627-23.patch2.41 KBankithashetty
#7 2491627-7.patch2.32 KBMattA
#7 2491627-7-test-only.patch711 bytesMattA
#7 2491627-4-7-interdiff.txt829 bytesMattA
#2 2491627-2.patch1.62 KBMattA
#4 2491627-4-block-admin-demo-theme-negotiator.patch2.39 KBmr.baileys
#4 2491627-4-block-admin-demo-theme-negotiator-test-only.patch785 bytesmr.baileys

Comments

David_Rothstein’s picture

David_Rothstein commented
Related issues: +#2491629: Block demo page shows regions to unprivileged users

Drupal 7 does not have this issue, but has a related issue instead.

MattA’s picture

MattA commented
Status: Active » Needs review
StatusFileSize
new 2491627-2.patch1.62 KB

For testing.

MattA’s picture

MattA commented
Issue summary: View changes
Status: Needs review » Needs work
Issue tags: +Needs tests

Edited IS to use template.

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Status: Needs work » Needs review
Issue tags: -Needs tests
StatusFileSize
new 2491627-4-block-admin-demo-theme-negotiator-test-only.patch785 bytes
new 2491627-4-block-admin-demo-theme-negotiator.patch2.39 KB

Patch with test attached.

The last submitted patch, 4: 2491627-4-block-admin-demo-theme-negotiator-test-only.patch, failed testing.

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Issue summary: View changes
MattA’s picture

MattA commented
StatusFileSize
new 2491627-4-7-interdiff.txt829 bytes
new 2491627-7-test-only.patch711 bytes
new 2491627-7.patch2.32 KB
  1. Updated the test comment because 'view the administration theme' is not actually checked. It is only used to control access for one theme, while AdminDemoNegotiator needs to know if the user has permission to see all of them (which is strongly implied when a user is granted 'administer blocks').
  2. Changed the test to check for the correct theme instead. This ensures that any other themes are not shown; otherwise we would need an assertNoRaw() for every available theme to make the test conclusive.

The last submitted patch, 7: 2491627-7-test-only.patch, failed testing.

MattA’s picture

MattA commented
Version: 8.0.x-dev » 8.2.x-dev

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.0-beta1 was released on August 3, 2016, which means new developments and disruptive changes should now be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

tinto’s picture

tinto
Location Amsterdam
commented
Status: Needs review » Needs work
Issue tags: +Bug Smash Initiative, +Needs reroll

The patch no longer applies against Drupal 9.4.x, as it targets

core/modules/block/src/Tests/BlockAdminThemeTest.php.

However, the location of this file is now:

/core/modules/block/tests/src/Functional/BlockAdminThemeTest.php

Changing the status of this issue to 'Needs work'.

ankithashetty’s picture

ankithashetty
Location Karnataka, India
commented
Status: Needs work » Needs review
Issue tags: -Needs reroll
StatusFileSize
new 2491627-23.patch2.41 KB
new interdiff_2491627_7-23.txt1.15 KB

Here is the rerolled patch. As suggested in #22, made changes to the new file /core/modules/block/tests/src/Functional/BlockAdminThemeTest.php. Also, removed the deprecated line $this->assertRaw('core/themes/classy'); and replaced it with $this->assertSession()->responseContains('core/themes/classy');.

Thanks!

Status: Needs review » Needs work

The last submitted patch, 23: 2491627-23.patch, failed testing. View results

abhijith s’s picture

abhijith s commented
StatusFileSize
new 3068698-before_patch.png7.45 KB
new 3068698-after_patch.png9.9 KB

Applied patch #23 on 9.5.x.The patch fixes the issue.The non admin theme will be shown after applying this patch for anonymous users in the
admin/structure/block/demo/seven page.

RTBC +1

abhijith s’s picture

abhijith s commented
abhijith s’s picture

abhijith s commented
StatusFileSize
new 2491627-before_patch.png16.74 KB
new 2491627-after_patch.png26.15 KB

Sorry, I've uploaded wrong screenshots.Please find the actual screenshots before and after applying patches.

Before patch:
before

After patch:
after

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.