Our userbase has a high turnover, and the concept of re-usable media assets has proven difficult to cement. To avoid users inadvertently impacting other users' pages we want to remove the ability to edit existing assets inline.
This functionality, coupled with the patch in the related issue, would provide a useful barrier to accidental alteration of assets. (Users can still update and even remove the assets via other methods.)
This patch (inbound shortly) creates a new setting which controls the display of the edit button. The setting does not apply to newly created entities -- they can be edited inline up until the node is saved and the entity is created in the DB.
#3143422: Allow to hide the Edit button in Complex widget
#2833972: Widget setting to allow or disallow deleting entities from the system
Issue fork inline_entity_form-2913571
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 2913571-3.x
changes, plain diff MR !127
- 2913571-add-a-setting
changes, plain diff MR !125
Comments
Comment #2
jrsouth commentedPatch based heavily on @jsbalsera's work in in issue #2833972
Comment #3
yasmeensalah commentedComment #4
jrsouth commentedThanks Yasmeen -- is that patch against beta1? (I haven't really been keeping an eye on this :) )
Comment #5
nkoporecRerolled the patch because of warning when you apply the patch, also setting Needs review so other people can test it.
Comment #6
useernamee commentedPatch #5 applies nicely. I have quickly manually tested it and it works. Changing status to RTbC.
Comment #7
maico de jongRerolled pattch #5
Comment #8
andrtroe commentedHello,
The #7 patch applied correctly and working as expected.
+1 for RTBC.
Tested on dev branch.
But it has conflicts with https://www.drupal.org/project/inline_entity_form/issues/2979075 so I applied all changes manually, but both patches work well together.
Also there are extra spaces in line
+ if (empty($entity_id) || ( $this->getSetting('allow_edit') && $entity->access('update') ) ) {
near brackets it should be removed.
Patch should be rerolled after https://www.drupal.org/project/inline_entity_form/issues/2979075 is commited.
Comment #9
andrtroe commentedComment #10
chris matthews commentedPer @joachim's comment in #2576445: Inline Entity Form stable release plan #20, this RTBC issue is blocked until #2974544: Convert tests from Simpletest to FunctionalJavascript is fixed.
Comment #11
geek-merlin#2974544: Convert tests from Simpletest to FunctionalJavascript is in now. I guess this should have a test.
Comment #12
geek-merlinComment #13
geek-merlinNW for tests.
Comment #14
xavier.massonReroll the patch
Comment #15
tonytheferg commentedWonderful Idea! #14 applied in core 9.0.3
Comment #16
spokjeLet's see if I can get up with some tests for this one.
Comment #17
spokjeMeh, got an unexpected other assignment, going to have to postpone my work on this one.
Comment #18
clairemistry commentedI applied #14 to D9 and then extended it to include the restriction on deletion functionality again that was available in the original patch as we needed that functionality for our site
Comment #19
kopeboy+1 for this on Drupal 10
Comment #20
kopeboyOh, now that I check, changing the permission to edit the entity already covers my requirement (with inline_entity_form 8.x-1.0-rc14 and Drupal 10)
Comment #21
jrsouth commentedRerolled to apply against RC15, however that version seems to introduce a related control (
removed_reference) which renders this patch partly redundant.Needs unpicking, but this should keep anyone currently using this patch running for the time being.
Comment #22
dcam commentedI suggest closing this issue as a "won't fix." This is a permission issue, not a reason to add more bloat to the field widget's settings. As noted in #20, Drupal Core includes granular permissions which may be configured to only allow access to edit or delete a user's own Media entities. In my opinion, this would need an explanation of how the permissions are insufficient enough to justify additional burden on maintainers and frankly every site builder who has to set up the widget.
Comment #23
jrsouth commentedI disagree, this suggested change directly addresses a common requirement of sites with large (and changing) user bases.
No matter how good the training is, users make mistakes. This is exacerbated by a changing population of users, e.g. as staff leave and arrive at an organisation. As site builders/admins, if we can easily prevent a mistake from being made, we should, and this change enables us to do so.
The classic example is a user creating a page containing a media item customised to that page. They then later create a separate new page and re-use the media item, editing it inline to be more suitable for this new page, without realising that it's now unsuitable for the original page.
You could argue that this is simply user error, but the suggested change allows site maintainers to easily prevent this common mistake from being made, which directly improves the user experience.
And yes, the permissions around editing/deleting a user's own media items are insufficient, as demonstrated by the example above — the unintended consequences are due to editing the user's own media entity. (And we certainly don't want to prevent editing wholesale, because that's still needed.)
There would be no burden on site builders, since it defaults to the current behaviour, making it purely opt-in.
The burden on maintainers is very likely to be minimal given the essentially static nature of this patch for the last 5+ years.
Comment #24
dwwYeah, I can see the benefit of allowing users to be able to edit their own entities (via other UI paths) but *not* to do so via IEF. I'm +1 to having these be widget settings. But for this to not be a maintenance burden, this feature *definitely* needs solid test coverage before it can be considered. Also, it should target the forthcoming 3.1.x series, since 3.0.0 is deep into RCs and IMHO it's too late to be adding new features there...
Comment #25
adr_p commentedRerolled against rc19 and:
empty($entity_id)calls (that don't work for entities with machine names) with$entity->isNew().Comment #27
rajab natshahFollowing up in this issue
After #3143422: Allow to hide the Edit button in Complex widget
Comment #29
rajab natshahDeleting existing entities can be in a new issue.
like #2833972: Widget setting to allow or disallow deleting entities from the system
Comment #30
rajab natshahComment #31
rajab natshahComment #32
rajab natshahComment #35
rajab natshahAttached a static
inline_entity_form--2024-12-27--2913571--mr-127.patchfile, from the MR127 up to this point.to be used with Composer Patches
Comment #37
loze commentedI tried this out but the new setting was not saving on the display form. I made a small change to the MR. Here is a patch for composer.
Comment #39
ahmad khader commentedAdded allow_edit to schema yml