The routing permission requirements for the Save & Edit settings form is currently using the "access administration pages" permission instead of the "administer save and edit" that is defined in the save_edit.permissions.yml file.

A user with access to the administration pages is currently able to edit the settings and the "administer save and edit" permission is not taken into account. I have an "editor" role that should not be able to alter this.

I'll attach a tiny patch that fixes this!

Cheers!

CommentFileSizeAuthor
#2 administer_permission-2940629.patch428 bytestonifisler

Comments

tonifisler created an issue. See original summary.

tonifisler’s picture

tonifisler commented
StatusFileSize
new administer_permission-2940629.patch428 bytes

Uploaded patch.

tonifisler’s picture

tonifisler commented
Status: Active » Needs review
prashant.c’s picture

prashant.c
he/him
Primary language English
Location Dharamshala
commented

@tonifisler

The permission is already defined for this access administration pages which will handle the permission for the configuration page.

I don't think we need specific permissions for this.

millionleaves’s picture

millionleaves commented
Status: Needs review » Reviewed & tested by the community

@tonifisler - thanks for the patch - this solved the problem for me.

This patch is required fo this module's permissions to be assigned in a sensible way. No new permissions are required or supplied by this patch - all it does is fix the existing permission, Administer Save and Edit, so it works as it should.

  • q__nt_n committed a8f94f2 on 8.x-1.x 
    Issue #2940629 by tonifisleri: Administer permission is not used for...
q__nt_n’s picture

q__nt_n
Primary language French
commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.