The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Currently, PanelsStorageInterface::access($id, $op, $account) takes the standard CRUD ops like create, read, write, delete.
We should add a special 'change layout' op that the IPE can use to see if the user has permission to change the layout in the underlying storage.
This is important because traditionally Panelizer has had seperate permissions for manipulating content and changing the layout (presumably to prevent certain users from changing the layout on certain types, only allowing them to change the content).
We'll need to add support for this to page_manager too, as it's the only other user of the PanelsStorage API.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | interdiff-2659546-5-7.txt | 2.6 KB | phenaproxima |
| #7 | 2659546-7.patch | 3.65 KB | phenaproxima |
| #5 | 2659546-5.patch | 764 bytes | phenaproxima |
| #3 | 2659546-3.patch | 3.12 KB | phenaproxima |
Comments
Comment #2
dsnopekComment #3
phenaproximaFirst attempt. This adds support for the "change layout" permission to Panels IPE.
Comment #5
phenaproximaFollowing discussion with @dsnopek on IRC, we decided to simply change the definition of PanelsStorageInterface::access so that the 'change layout' permission implicitly checks the 'update' permission. There is no implementation of this class in Panels itself, so all the patch needs is a doc comment change.
Comment #7
phenaproximaAdded more access control -- the layout form is no longer accessible without the 'change layout' permission, and the Panels IPE JavaScript will respect that as well and hide the "Change Layout" tab if the user does not have the appropriate access.
Comment #12
japerryLooks good, merged in.