Problem/Motivation
The \Drupal\views\Plugin\views\field\LinkBase::render() method is presuming too much by not rendering a link whose destination page is not accessible by the current user. The actual behaviour could cover most of the cases but there are still business scenarios when a role should be able to list content, including the URL, but still without the ability to access the content page. This is somehow similar to view label entity access introduced in https://www.drupal.org/node/2661092.
Not having access to a content item, doesn't mean automatically that the content's address cannot be read.
Proposed resolution
Add a new option "bypass_access" in \Drupal\views\Plugin\views\field\LinkBase that allows the site builder to bypass the access check when a link is rendered. The new option should default to FALSE, so the behavior of the actual will not be changed.
Remaining tasks
None.
User interface changes
New option as a checkbox the the Views link fields.
API changes
None.
Data model changes
Views config new option in fields.
| Comment | File | Size | Author |
|---|---|---|---|
| #26 | 3008254-26-9.3.x.patch | 10.38 KB | pfrenssen |
Issue fork drupal-3008254
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
claudiu.cristeaHere's a patch.
Comment #3
dimilias commentedThat is an initial review. However, I am not 100% familiar with the link base and the usage in Drupal (like the Url class) so it would be nice to have more than one reviews on that.
"When checked" is more appropriate here.
This can be added in the access check below as
Comment #4
dhirendra.mishra commentedworking on it
Comment #5
claudiu.cristeaFixed requests from #3. I improved more the description message.
Comment #6
dimilias commentedPatch works fine for me. Setting to rtbc.
Comment #8
dimilias commentedComment #9
dimilias commentedChanging this to needs work as the tests failed.
Comment #10
claudiu.cristeaComment #11
claudiu.cristeaIt was the branch that failed. Back to RTBC as the branch test passed and the patch is back to green.
Comment #12
alexpottI'm not entirely sure about the rationale stated in the issue summary. Drupal goes out of its way very often to not render links to things a re user does not have access to. Are we sure this functionality is core-worthy? It'd be great to see a views maintainer or product manager chime in on this issue.
Use ConfigEntityUpdateer to do this in a batch. See views_post_update_table_display_cache_max_age() for an example.
Comment #13
claudiu.cristea@alexpott, Drupal renders entity labels even the user don't have access to render the entity ('view label' permission).
Comment #14
alexpott@claudiu.cristea yeah but that is a bug.
Comment #15
lendudeYeah this feels very edge case-y to me. Anything that adds something called 'bypass_access_check' gives me pause.
Is there any reason that when you need this you can't just extend whatever plugin you need to override and hook_field_views_data_alter/hook_views_data_alter to use your plugin for the appropriate fields? I understand that this can be hassle if you want this for all plugins extending LinkBase, but realistically we are only talking about EntityLink right (RevisionLinkRevert anybody?).
Well that's my 2 cents any way.
Comment #16
claudiu.cristea@alexpott, @Lendude
Thank you for your feedback.
Yes, but it was introduced to satisfy the need of allowing to access entity listings without being able to access the rendered entity or the entity edit form. In the real world the permission to access the content listing may be be different than the access to the content item itself. #2953566: Allow entities to specify a "collection permission" has a good description showing why sometime accessing content lists should be allowed while still not being able to access the full content item.
Also I think the current behavior is wrong. A link that you cannot "see" is, IMO, a link that returns 404. The link doesn't exist because the destination page doesn't exist. A link that returns 403 is a "known" link, just that you'll receive a 403 if you're trying to follow. What now the plugin is doing, is just obscuring a link which you cannot access.
Comment #19
claudiu.cristeaReroll for 8.8.x.
Comment #26
pfrenssenRerolled against 9.4.x and opened a MR for it.
Here is also a patch rolled against the current stable 9.3.x. branch.
Comment #29
claudiu.cristeaThis doesn't seem to be a very popular solution. Closing.