Problem/Motivation

There is no permission to control the access to the mini layouts. The current implementation of layout builder (at least on Drupal 9.x) is controlling the access to blocks based on the access of the parent entity, in this case the mini_layout entity.

Steps to reproduce

  • Install mini_layouts module in a Drupal 9 site
  • Create a mini layout and place a content block on it
  • Place the mini layout block on a page
  • See that page as anonymous user. The mini layout will be present but the content block will be hidden.

Proposed resolution

  • Create a new permission "access mini layouts"
  • Implement the \Drupal\mini_layouts\Entity\MiniLayoutAccessControlHandler::access() method and check the "access mini layouts" permission

Remaining tasks

Review and test

User interface changes

None

API changes

New permission "access mini layouts"

Data model changes

None

Comments

akalam created an issue. See original summary.

akalam’s picture

Status: Active » Needs review
StatusFileSize
new1.86 KB
akalam’s picture

StatusFileSize
new1.9 KB
new675 bytes

Previous patch is throwing a fatal error on admin pages if $account is not defined. Here is a patch fixing it.

akalam’s picture

rlmumford’s picture

Status: Needs review » Needs work

This should override the 'checkAccess' method instead of the 'access' method, that would resolve the issue with $account being NULL.

milos.kroulik’s picture

StatusFileSize
new1.07 KB
new1.34 KB

Fixed issue mentioned in #5.

milos.kroulik’s picture

Status: Needs work » Needs review