Problem/Motivation

When you have a "Needs review" published state for a content moderation workflow and decide to switch the 'published' property to FALSE, the moderated content with that state will not be updated to reflect the new publishing status.

Since the publishing status for existing moderated content is not updated, changing an already existing moderation state like mentioned above will introduce an access bypass issue for any view listing that content.

Proposed resolution

Disallow changing the 'published' property of a moderation state after it has been added to a workflow.

Remaining tasks

- code this in \Drupal\content_moderation\EventSubscriber\ConfigImportSubscriber too
- add tests

User interface changes

The 'Published' checkbox from the State edit form will now be disabled.

API changes

Nope.

Data model changes

Nope.

CommentFileSizeAuthor
#6 2907453-6.patch2.11 KBvijaycs85
#6 2907453-6-test-only-fail.patch1.32 KBvijaycs85
#2 2907453.patch805 bytesamateescu

Comments

amateescu created an issue. See original summary.

amateescu’s picture

amateescu commented
Status: Active » Needs work
Issue tags: +Needs tests
StatusFileSize
new 2907453.patch805 bytes

This takes care of the UI part, we still to code this into \Drupal\content_moderation\EventSubscriber\ConfigImportSubscriber and add tests.

xjm’s picture

xjm
she/her
Primary language English
commented

I think what we actually need to do is prevent it from being changed once there is content in the state? Otherwise I can see the limitation getting really annoying otherwise; I can imagine having to delete and re-create states all the time.

xjm’s picture

xjm
she/her
Primary language English
commented

Or, alternately, we need a batch update to publish or unpublish the entities as appropriate. I could see a short-term fix that disallows it when there's any content in the state and the batch operation as a longer term solution.

amateescu’s picture

amateescu commented

I think what we actually need to do is prevent it from being changed once there is content in the state?

Even when there is no content in the state, there might other parts of the system (let's say.. a view :P) that operate under the impression that content in this state is considered published/unpublished, so I think the current approach is much safer, as annoying as it might be.

vijaycs85’s picture

vijaycs85
Location London, UK
commented
Status: Needs work » Needs review
Issue tags: -Needs tests
StatusFileSize
new 2907453-6-test-only-fail.patch1.32 KB
new 2907453-6.patch2.11 KB

Adding test. Just changing the status to needs to review to test.

The last submitted patch, 6: 2907453-6-test-only-fail.patch, failed testing. View results

timmillwood’s picture

timmillwood
Primary language English
Location 🏴󠁧󠁢󠁷󠁬󠁳󠁿 Wales, UK
commented
Status: Needs review » Needs work

Moving back to "Needs work" for the ConfigImportSubscriber part mentioned in #2.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

rakesh.gectcr’s picture

rakesh.gectcr
he/him
Primary language English
Location Manchester
commented
Assigned: Unassigned » rakesh.gectcr

Assigning myself to give it try,

Did talk with tim on slack about isuue and he had given me the directions to approach this issue.

Rakesh James Hi Tim, I am planning to jump into https://www.drupal.org/node/2907453#comment-12251129
Drupal.org
Do not allow changing the "published" property of a moderation state after the state has been added to a workflow
Problem/Motivation When you have a "Needs review" published state for a content moderation workflow and decide to switch the 'published' property to FALSE, the moderated content with that state will not be updated to reflect the new publishing status. Since the publishing status for existing moderated content is not updated, changing an already existing moderation state like mentioned above will introduce an access bypass issue for any view listing that content. Proposed resolution
[3:02 PM]
Tim Millwood awesome!
There's an example of a config import subscriber at `\Drupal\content_moderation\EventSubscriber\ConfigImportSubscriber`.
[3:03 PM]
Rakesh James It will be great, If you can post a direction as comment
Ok thank you
[3:04 PM]
Tim Millwood The existing one checks if the state of the workflow is being used, in this new patch we also need to check the "published" property of a state doesn't change.
You'll need to loop through each state, comparing the "published" property from the `$original_workflow_config` and the `$workflow_config`.
[3:05 PM]
Rakesh James ok thank you, that makes a lot of sense to me.
Can I copy paste your comments on the issue

[3:06 PM]
Tim Millwood Sure.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

smustgrave commented
Assigned: rakesh.gectcr » Unassigned
Issue tags: +Bug Smash Initiative

This came up as a daily BSI target

Un-assigning as it's been 8 years :)

I see there was a rough patch probably good to turn into an MR going forward.

Seems this still needs the ConfigImporter part though.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.