As a parallel of #2600382: Come up with a simple access/permission system for Workspaces, we shouldn't allow users to switch to a workspace they don't have permission to see.
This patch may not work properly without the patch from that issue on workspace, but I haven't actually tried it independently, so... (But really, it should, because all it does is check entity access which doesn't need another module.)
There's also a little bit of code cleanup and refactoring in there that I did while figuring out what I needed to do here. It's not relevant to this issue but I thought it was a good change anyway and it was not worth splitting up the diff to exclude. Sorry. :-)
Comments
Comment #2
timmillwoodTo test this I setup a test user (with no other roles than Authenticated user, and default permissions for that), added the workspace switcher block which ships with Workspace module, and created a new workspace.
When logging in as the test user I could see the workspace switcher block, as I hadn't set any permissions for that block, when switching workspace I got the following message in a dsm:
I think this is the intended behaviour, but the dsm is confusing. My vote would be to remote the "New viewing workspace X" message from \Drupal\workspace\Form\WorkspaceActivateFormBase::submitForm and set this in \Drupal\multiversion\Workspace\WorkspaceManager::setActiveWorkspace if the active workspace successfully switched. Thoughts?
Edit: I think it's worth noting that I tested this patch on it's own, without applying the patch from #2600382: Come up with a simple access/permission system for Workspaces Assigned to: Crell.
Comment #3
Crell commentedActually I can do you one better. Exceptions FTW! This also removes the dsm() from a service, which shouldn't have it anyway. (I hope this passes...)
Comment #5
timmillwoodComment #7
timmillwoodHad second thoughts!
There are several places (mainly tests) where we set the the active workspace, and many of these wouldn't have an
$accountto go with them. We need a way to set an active workspace without checking access, maybesetActiveWorkspace(WorkspaceInterface $workspace, $access_bypass = FALSE)?These are the places we're using it:
Comment #8
Crell commentedHm. I detest boolean flags like that on methods, as they're a code smell.
The alternative is to move the permission check to everywhere that we call setActiveWorkspace(), which would resolve this issue but also open up a potential security issue; forget to call it once and bam, privilege escalation. Could we perhaps optionally provide a user to the method, and pass that to access()? Then at least in tests you could pass in a mock user.
Comment #10
timmillwoodLittle more than a re-roll.
Tests running at https://travis-ci.org/dickolsson/drupal-multiversion/jobs/120100452
Comment #12
timmillwood