Hi All,

With the same issue as https://www.drupal.org/node/2078423 for Drupal 7, Drupal 8 Redirect grants access to edit the redirect URLs as well as change the redirect general settings with the same permission.

The settings page is useful for technical administrators but is difficult for less technical site editors to understand and unnecessary for them to be able to use the core functionality of this module.

I will submit a patch with a proposed solution shortly.

Thanks,
Scott

Comments

scott_euser created an issue. See original summary.

scott_euser’s picture

This patch separates the settings page into a new permission and adds a hook_update_n to maintain existing access for sites with this module already installed.

scott_euser’s picture

Status: Active » Needs review

Status: Needs review » Needs work
berdir’s picture

Works for me but needs a reroll.

scott_euser’s picture

Status: Needs work » Needs review

Hmmm strange it is stuck on 'Running' for a few hours now. Will see if switching it to needs review will jolt it back to life.

Status: Needs review » Needs work
scott_euser’s picture

Status: Needs work » Needs review
StatusFileSize
new1.74 KB

Updated patch to match changes since patch originally submitted (no change besides hook_update_n number), should apply now.

Status: Needs review » Needs work
scott_euser’s picture

Updated with changes to test permissions to match new permission change

scott_euser’s picture

Status: Needs work » Needs review
berdir’s picture

Status: Needs review » Needs work

The new 404 module has an ignore feature that redirects to the settings page to configure the ignore filter. We probably need to limit that to users with settings permission.

Also, updating the description of the existing permission to clarify that you can Manage URL redirects but not change the settings or so.

scott_euser’s picture

Hmmm I am not sure how to handle the access in the Redirect404Operations views field. Does it need to have add and ignore placed into two separate fields? It seems the access method in there is an all or nothing for the contents of the render (or am I looking at it wrong?). Am I right in assuming it is not appropriate to wrap the Ignore operation in an if statement with something like:

$user = \Drupal::currentUser();
if ($user->hasPermission('administer redirect settings')) {
  // Etc.
}

Stepping back a bit, perhaps a site editor who is not allowed to change the global redirect settings should still be allowed to ignore a 404 URL. I imagine that would be a bit more complicated since you use the redirect global config to handle ignores (redirects = content and redirect 404 ignores = config?).

Re the permission descriptions, is this more accurate:

administer redirects:
  title: 'Administer individual URL redirections'
administer redirect settings:
  title: 'Administer global URL redirection settings'
berdir’s picture

I think a if condition around one of the two links is perfectly, depending on how it is set you can maybe even use #acess.

I think preventing ignore for now is fine, we can still extend it later.

scott_euser’s picture

Status: Needs work » Needs review
StatusFileSize
new6.44 KB
new3.13 KB

Sounds good thanks! I couldn't see how to make access work on a single link as both links get added to the same render element (putting #access on the link has no effect) so I did go with the if statement. Added in the user via dependency injection. Also updated the 404 routing yml file accordingly.

scott_euser’s picture

If you are happy with this one after the above discussion, okay to mark as 'reviewed and tested by the community'.

Please let me know if you have any further issues or blockers on this that you'd like me to address.

Thanks!
Scott

stefanos.petrakis’s picture

Needed a tiny reroll because of a function naming conflict (redirect_update_8106 already taken).
This came from the latest alpha release, 8.x-1.0-alpha3 (commit: d1eaf7c7a9d12fdd496e7c4ded094daf3e2ac552).

berdir’s picture

Note that if you had this patch applied then the other update function wasn't executed for you, and you will need to make that configuration change/cleanup by hand.

scott_euser’s picture

Sounds good thanks!

  • Berdir committed 6d43539 on 8.x-1.x authored by scott_euser
    Issue #2826014 by scott_euser, stefanos.petrakis: Separate URL and...
berdir’s picture

Status: Needs review » Fixed

Thanks, committed. Sorry for the delay.

scott_euser’s picture

Thanks and no problem!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.