Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.There is a scenario where a user has the view to edit a piece of content, but there is no button to save the edited content. Here is one scenario where this can be reproduced:
- create user with only the "Authenticated user" role
- allow authenticated users to have all permissions to the Article content type
- make Article moderatable with all states checked and default status to draft
- login as the user you just created
- go to create an Article and you will see an interface to edit content, but no save button (only a preview button)
While this isn't a severe scenario, easily remedied by giving transition permissions, it could be a common scenario for sites with many editorial steps.
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | interdiff-2675740.txt | 1.1 KB | Crell |
| #11 | 2675740-edit-access.patch | 1.48 KB | Crell |
Comments
Comment #2
Crell CreditAttribution: Crell at Palantir.net for Acquia commentedThe straightforward solution would be to modify the entity permission hook we already implement and deny Edit access if the user has no out-going transition permissions. That may have a negative performance impact, though. It also means that the Edit tab would simply not be available for those users, which could be confusing.
Comment #3
Crell CreditAttribution: Crell at Palantir.net for Acquia commentedBasically this.
Comment #7
Crell CreditAttribution: Crell at Palantir.net for Acquia commentedBy which I of course mean this.
Comment #11
Crell CreditAttribution: Crell at Palantir.net for Acquia commentedI don't like the resulting code, but edge cases...
Comment #13
Crell CreditAttribution: Crell at Palantir.net for Acquia commentedI went ahead and merged this.