Problem/Motivation

If a user does not have edit access to any menus shown on /admin/structure/domain-menus, all menus are shown here.
This does not make any sense, cause users cannot do anything here/ have no actions buttons.
This is based on the fact, that the filter logic in DomainMenusListBuilder will not work in case of empty $menus array - in this case the query will run without filtering.

Steps to reproduce

  • Create some domains: Domain A, Domain B, Domain C
  • Create some menus with following relations: Menu 1 -> Domain A, Domain B, Menu 2 -> Domain B
  • Create a user with permission Edit active domain menus and associate it to Domain C
  • Login to Domain C and open /admin/structure/domain-menus
  • All available menus will be shown here

Proposed resolution

In case of having zero results in the filtering, the list of menus should be empty on /admin/structure/domain-menus.

Remaining tasks

I'll add a Merge Request in this issue, fixing the issue.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

SteffenR created an issue. See original summary.

steffenr’s picture

Assigned: steffenr » Unassigned
Status: Active » Needs review
steffenr’s picture

Title: DomainMenusListBuilder shows all menus, if user has no edit access to all menus » DomainMenusListBuilder shows all menus, if user has no edit access to any of them

  • drpldrp committed 0db203e on 3.x authored by SteffenR
    Issue #3290733: DomainMenusListBuilder shows all menus, if user has no...
drpldrp’s picture

Status: Needs review » Fixed

Fixed in 3.4.1.

drpldrp’s picture

Status: Fixed » Closed (fixed)