Problem/Motivation

Steps to reproduce

  1. Install the latest Drupal 8.0.x, enable Content Translation module and dependencies.
  2. Enable a second language (like French), and enable a content type for translation (like an article)
  3. Place the "language switcher block" in any region (on all pages)
  4. Create an article in English and publish it.
  5. Translate the article into the second language, but save it as unpublished (or just unpublish it).
  6. Log out and view the English article you created (probably node/1)
  7. In the language switcher block you placed on the page, you can see and click the second language you created (like French)
  8. Doing so will land you on a 403 access denied

Expected Behavior
The second language link in the language switcher block (French) should have never been shown to the unauthenticated user because the user did not have access to it (but it should still be shown to the authenticated user who does have access).

Proposed resolution

@todo

Remaining tasks

@todo

User interface changes

@todo

API changes

@todo

Comments

iamEAP’s picture

iamEAP commented
Related issues: +#366768: Translation links link to unpublished translation

Adding relation to the issue from D7 where this was first resolved.

nagwani’s picture

nagwani commented

Working on traiging this issue.

nagwani’s picture

nagwani commented
Issue tags: +drupalconasia2016, +Triaged for D8 major current state

I am able to reproduce this issue based on the steps to reproduce mentioned in the description of the ticket. Tested on 8.1.x branch.

dineshw’s picture

dineshw commented
Assigned: Unassigned » dineshw
kuntalsarkar2’s picture

kuntalsarkar2 commented
Assigned: dineshw » kuntalsarkar2
kuntalsarkar2’s picture

kuntalsarkar2 commented

I am able to replicate this issue based on the steps to reproduce.

xjm’s picture

xjm
she/her
Primary language English
commented

(Updating issue credit for the major triage.)

effulgentsia’s picture

effulgentsia commented
Issue tags: -Triaged for D8 major current state +Triaged core major

Discussed this with @catch, @alexpott, @xjm, and @Cottser, and we agreed this is Major. We considered whether it should be Critical, but decided no, because the only information disclosed in the link is the name of the language, and not anything about the unpublished translation, other than its existence, which you can determine anyway by typing the language-prefixed URL into the address bar.

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

ckaotik’s picture

ckaotik
Primary language German
Location Berlin
commented

I wonder if this also affects other parts of the site, e.g. alternate links in the page <head>?

For the time being, we've been using this hook to hide inaccessible links:

function hook_language_switch_links_alter(array &$links, $type, Url $url) {
  // Get the page entity.
  $entity = NULL;
  foreach (\Drupal::routeMatch()->getParameters() as $key => $parameter) {
    if (($parameter instanceof EntityInterface) && ($parameter instanceof TranslatableInterface)) {
      $entity = $parameter;
      break;
    }
  }

  foreach ($links as $langcode => &$link) {
    if ($entity && (!$entity->hasTranslation($langcode) || !$entity->getTranslation($langcode)->access('view'))) {
      unset($links[$langcode]);
    }
  }
}

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

stevendeleus’s picture

stevendeleus commented

For #12 you need:

<?php
use Drupal\Core\Entity\EntityInterface;
use Drupal\Core\Entity\TranslatableInterface;
use Drupal\Core\Url;
?>

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

mohit_aghera’s picture

mohit_aghera commented
Assigned: kuntalsarkar2 » Unassigned
Status: Active » Postponed (maintainer needs more info)
Issue tags: +Bug Smash Initiative

I came across this issue while doing bug-smash traige.
I was not able to reproduce the issue.

  • I tested on latest main branch and install Umami
  • Create article in English and publish it
  • Create "Spanish" translation of above article and keep it in draft
  • Place language switcher block
  • Visit the English article as an anonymous user
  • We can see English content and language switcher is visible with both the links
  • Click on "Spanish" translation link and it falls back to English translation
  • It seems that language fallback is kicking in and displaying English translation
  • I am not sure if I am missing something.

However, I see an issue is still valid.
If "Spanish" translation is not published, it shouldn't display the links.

Possibly ConfigurableLanguageManager::getLanguageSwitchLinks() method should ensure that translation access is allowed.
However, that place is little tricky since we will have to do another entity load for the same

mohit_aghera’s picture

mohit_aghera commented
Status: Postponed (maintainer needs more info) » Active