Problem/Motivation

In this issue #2172017: Bulk operations does not respect entity access was added entity access check for when you apply the action. But still for the user should not see a action that he can not perform.
So we should add a way to check if the user is able to perform an action over an entity type and if so show the action in the bulk.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#21 bulkform_should_not-2656854-21.patch2.99 KBSomeIntern
#21 bulkform_should_not-2656854-21.interdiff.txt432 bytesSomeIntern
#20 bulkform_should_not-2656854-20.interdiff.txt409 bytesSomeIntern
#20 bulkform_should_not-2656854-20.patch3.06 KBSomeIntern
#19 bulkform_should_not-2656854-19.patch3.07 KBSomeIntern
#17 bulkform_should_not-2656854-17.patch1.48 KBSomeIntern
#12 interdiff-2656854-2-12.txt1.58 KBhardik_patel_12
#12 bulkform_should_not-2656854-12.patch3.07 KBhardik_patel_12
#2 bulkform_should_not-2656854-2.patch3.07 KBedurenye

Comments

edurenye created an issue. See original summary.

edurenye’s picture

edurenye commented
Assigned: Unassigned » edurenye
Status: Active » Needs review
StatusFileSize
new bulkform_should_not-2656854-2.patch3.07 KB

I propose to use a Trait as we can not modify ActionInterface.
This is the first approach.

What do you think?

swentel’s picture

swentel commented
Related issues: +#2656898: BulkForm show two messages if you don't have permission to do the action

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

dunebl’s picture

dunebl
Primary language French
commented
Issue tags: +Needs reroll

This patch needs at least a reroll and a review

hardik_patel_12’s picture

hardik_patel_12 commented
StatusFileSize
new bulkform_should_not-2656854-12.patch3.07 KB
new interdiff-2656854-2-12.txt1.58 KB

Re-roll for 8.8.x-dev.

dunebl’s picture

dunebl
Primary language French
commented

This patche apply cleanly, but it doesn't remove actions for which the current user doesn't have access.
Exemple:
Under /admin/people there is the 'cancel user' action (coming from a 'bulk operation' field in a view).
A user without the right to delete other users will see this action (trying to using it will trigger an error).
The purpose of this patch should be to avoid that.

Am I missing something?

joachim’s picture

joachim commented
Status: Needs review » Needs work
Issue tags: +Needs tests 
+++ b/core/lib/Drupal/Core/Action/ActionEntityTypeAccessTrait.php
@@ -0,0 +1,39 @@
+trait ActionEntityTypeAccessTrait {

Nothing's using this trait...?

Also, don't all actions involve entities? Couldn't this be added to the plugin base class instead?

Also, sounds like this needs tests.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

damienmckenna’s picture

damienmckenna
Location TN, USA
commented
Version: 8.9.x-dev » 9.4.x-dev
Assigned: edurenye » Unassigned

As a reminder, the "assigned" field is for indicating you're actively working on an issue, once you're finished you should change it back to "unassigned".

SomeIntern’s picture

SomeIntern commented
Status: Needs work » Needs review
StatusFileSize
new bulkform_should_not-2656854-17.patch1.48 KB

reroll of #12 for 9.4.x

SomeIntern’s picture

SomeIntern commented
Assigned: Unassigned » SomeIntern

fixing my reroll

SomeIntern’s picture

SomeIntern commented
Assigned: SomeIntern » Unassigned
Issue tags: -Needs reroll
StatusFileSize
new bulkform_should_not-2656854-19.patch3.07 KB

reroll of #12 for 9.4.x

SomeIntern’s picture

SomeIntern commented
StatusFileSize
new bulkform_should_not-2656854-20.patch3.06 KB
new bulkform_should_not-2656854-20.interdiff.txt409 bytes

updated patch in #19

SomeIntern’s picture

SomeIntern commented
StatusFileSize
new bulkform_should_not-2656854-21.interdiff.txt432 bytes
new bulkform_should_not-2656854-21.patch2.99 KB

updated patch in #20

joachim’s picture

joachim commented
Status: Needs review » Needs work 
  1. +++ b/core/lib/Drupal/Core/Action/ActionEntityTypeAccessTrait.php
@@ -0,0 +1,35 @@
+   * Checks EntityType access.

    Should be 'entity type' in comments. 

  2. +++ b/core/lib/Drupal/Core/Action/ActionEntityTypeAccessTrait.php
@@ -0,0 +1,35 @@
+   * @param bool $return_as_object
+   *   (optional) Defaults to FALSE.

    Do we need this option? We're the only caller and we know we want a boolean. 

  3. +++ b/core/modules/views/src/Plugin/views/field/BulkForm.php
@@ -315,10 +316,24 @@ public function viewsForm(&$form, FormStateInterface $form_state) {
+        if (in_array(ActionEntityTypeAccessTrait::class, class_uses($plugin))) {

    I don't really understand why this method doesn't just go in the Action plugin base class? All actions operate on entities, so checking access is always relevant.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mstrelan’s picture

mstrelan commented
Component: system.module » views.module

BulkForm was moved to views.module in #2916451: Move everything related to Bulk Form to Views module, updating component

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.