Broken links report

Yes, need to be migrated to views. Where are you checking if the user has permission to view a link?

I guess this needs a rerole after the many other commits?

Re-roll of patch at #7 against linkchecker-8.x-1.x-dev (29 May 2019).

Forgot to add the view.

Sigh.

Moved /config/optional/views.view.broken_links_report.yml to /config/install/views.view.broken_links_report.yml

Use patch at #11.

From CR:

If a module, theme or profile provides configuration that has additional dependencies that might not be met during its installation then this configuration should be stored in config/optional. For example, the Node module provides the frontpage view. The Node module does not depend on Views. Therefore, views.view.frontpage.yml must be stored in Node's config/optional directory.

1. Re-roll patch at #11 against linkchecker-8.x-1.x-dev (29 May 2019) - 5fcf109d

2. Fixed views broken/missing handler for Entity Field.

3. Enabled contextual link in view.

Now that the report is available in views, I think the rest of the customizations can be done by the end user to fit their needs.

Once the reports are migrated to views - linkchecker depends on views.

We cannot commit this view as it adds a security bug. perm: 'access broken links report' Is not correct. The user that views the view may not allowed to see a content type field a link is extracted from. Such links may contain passwords what will cause security bypass to users with ‚access broken links report' permission.

Since we know now from what entity the link comes from, we could check the field permission of the current user has access too and exclude these links from the report.

Re: #16. Is adding text to the permission acceptable for now or maybe calling the permission View Any Broken links report?

Warning: Give to trusted roles only; this permission has security implications.

This may allow you to commit this patch and keep the D8 release moving forward.

We can then open a new issue to create View Own Broken links report; or something similar.

Re: #18. Sorry. I didn’t realise you already implemented the permissions in linkchecker.permissions.yml:

1. I think @hass is correct. The ‘Access broken links report’ permission should have restrict access: true.

2. With respect to linkchecker.routing.yml, are the report permissions taken care of here or are they part of the view:

linkchecker.admin_report_page:
  path: '/admin/reports/linkchecker'
  defaults:
    _controller: '\Drupal\linkchecker\Controller\LinkCheckerAdminReportPage::content'
    _title: 'Broken links'
  requirements:
    _permission: 'access broken links report'

linkchecker.user_report_page:
  path: '/user/{user}/linkchecker'
  defaults:
    _title: 'Broken links'
    _controller: '\Drupal\linkchecker\Controller\LinkCheckerUserReportPage::content'
  options:
    _admin_route: TRUE
  requirements:
    _custom_access: '\Drupal\linkchecker\Controller\LinkCheckerUserReportPage::access'
    user: \d+

3. I don’t see the the view display for /user/{user}/linkchecker. Should I build that?

@pnagornyak: Can we prove the entity permission works properly with a test, please?

I don’t see the the view display for /user/{user}/linkchecker. Should I build that?

Yes, but we should handle this in an extra case so that this case here does not get blocked by it.

Re: #18. I can confirm in my local env, that I have given a user without any nodes/entities, only permission ‘Access broken links report’.

The user has access to all links in the Broken links report.

How is the access handler supposed to be used in the view?

Patch at #24 looks good. I also think @pnagornyak's interpretation of @hass' requirement at #4 is a good one.

Instead of:

checking if the user has permission to view a link

Check if users have view access to field containing a link.

If a user does not have view access to the field containing a link, he will not see the URL in the Report as shown in @pnagornyak's attached image.

Are we able to filter the View if URL is empty, so a user will not see these rows at all? If that could be done, I'd call this perfect.

Can we add a text like "Permission restrictions deny you access to this broken link." (as in D7) as replacement to no URL?

I committed this as-is in hope it is done correctly. Lets fix the remaining stuff in follow ups.