The button "create content" in the Panels IPE is displayed unconditionally. This means that a user with rights to use the Panels IPE (for example, in combination with panelizer) that doesn't have access to the the "administer blocks" permission will get a button, but clicking the button will result in an error in the backend and an empty form in the frontend.

Members fund testing for the Drupal project. Drupal Association Learn more

Comments

floretan created an issue. See original summary.

japerry’s picture

samuel.mortenson’s picture

Status: Active » Needs review
FileSize
3.94 KB

Here's a patch which checks for access before displaying the "Create content" button, in addition to removing the "Edit" action on Blocks if the user doesn't have access.

sylus’s picture

I just checked this myself:

Created another user with just Authenticated Roles

- Added all Panels permissions
- Added Panels IPE permission
- Added Page Manager permission

Logged in as user with just authenticated role (not user 1) and saw the "Create Content" section.

I applied the patch and refreshed the page and the "Create Content" section was gone. When I added the "Administer Blocks" permission to the authenticated role then the section appeared again.

Thanks so much!

sylus’s picture

Status: Needs review » Reviewed & tested by the community

  • samuel.mortenson committed ed0b743 on 8.x-3.x
    Issue #2767009 by samuel.mortenson: "Create content" is displayed...
samuel.mortenson’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.