Panels IPE javascript loaded, even when you have no access to the in place editor

Good catch!

However, I think this should be inside of the existing if() { ... } statement just before the $build['#attached']['library'][] = 'panelizer/panels_ipe'; (I think it's that line that's causing the Panels IPE Javascript to be added, since it depends on it).

And, maybe rather than checking for the permission, we could check something on the $build array that would let us know if the IPE added itself? Otherwise, we could be getting the permissions wrong if/when this issue is committed: #2667754: Allow other modules to disable the IPE based on custom logic. Maybe it could look in $build['#attached']['library'] and if it finds the IPE Javascript, it could figure it's safe to add the Panelizer Javascript?

Just came across this as well - #2717561: JavaScript should only be rendering on the page if the user has access to use panels_ipe. Closed that as a duplicate.

Working on a new patch for this, based on the suggestions from #8

New patch based on the suggestions from #8. This will disable the attachment of the Panelizer library any time the panels_ipe/panels_ipe library isn't already attached.

I've tested it for Anonymous and Authenticated users without sufficient privileges to use the IPE, and verified no IPE-related JS files were linked.

Thanks! Committed. :-)

It seems that this change has started to cause some notices and warnings to show for me.

Notice: Undefined index: #attached in panelizer_panels_build_alter() (line 101 of modules/contrib/panelizer/panelizer.module).

I believe that the issue has some roots in the fact I am using workbench moderation so am not 100% sure which module is causing this issue. However I was wondering if there was any reason why a test to see it the '#attached' key exists before accessing the 'library' key.

something along the lines of

if (isPanelizer($build, $builder, $storage_type)) {

....

function isPanelizer(&$build, $builder, $storage_type)
{
  return $builder->getPluginId() == 'ipe' &&
  in_array($storage_type, ['panelizer_default', 'panelizer_field']) &&
  in_array('#attached', $build) &&
  in_array('library', $build['#attached']) &&
  in_array('panels_ipe/panels_ipe', $build['#attached']['library']);
}

thoughs?

Aaron

Here is a patch with my idea.

Thanks!

A couple things:

1. Let's make a new issue that links back to this issue. While they're related, we accomplished the original goal here, which is not to load the the IPE javascript when you have no access to the IPE. Making a separate issue will make our Git history easier to understand
2. Using isset() is easier to read and fits in with other Drupal code better than in_array(), for example: isset($build['#attached'])
3. I don't think we should make a separate function, because it's available globally and there's no other use for it really. I'd say declare a variable in the original function that's like:
   

   $is_panelizer = $builder->getPluginId() == 'ipe' &&
     in_array($storage_type, ['panelizer_default', 'panelizer_field']) &&
     in_array('#attached', $build) &&
     in_array('library', $build['#attached']) &&
     in_array('panels_ipe/panels_ipe', $build['#attached']['library']);
   

I'm looking forward to the new issue and patch ;-)

I have created a new issue (2760051) as per direction of @dsnopek and posted new patch there. Thanks for your reply.