Revisions tab shows up when the anonymous user accesses the Webforms [#3328890]

Problem/Motivation

Revisions tab is shown up when the anonymous user accesses the Webforms. The anonymous user should not see the "Revisions" and "View" Tabs.

Steps to reproduce

Drupal Environment:
Drupal Core 9.4.7
PHP 8.0

1) Installed and enabled the Config Revision (1.0.0-alpha3).
2) Applied Config Revision patch (#2350939-202) or (2350939-254): Implement a generic revision UI.
3) Enable "Webform" in Config Revision Settings (/admin/config/development/config-revision)
4) Installed and enabled Webform Revision UI module

As a result, Revisions and View Tabs are shown up when the anonymous user accesses the Webforms.

I have temporarily used CSS to hide the tabs from the anonymous user.

body.anonymous.path-webform ul.tabs--primary.nav.nav-tabs {
display: none;
}

Revisions tab issue

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comment	File	Size	Author
	Revisions_tab_Iusse_for_Anonymous_User.png	23.26 KB	jamesyao

Issue fork webform_revision_ui-3328890

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

fix/3328890-revisions-tab-access changes, plain diff MR !2
Check out this branch for the first time

Check out existing branch, if you already have it locally
3328890-revisions-tab-shows changes, plain diff MR !1
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

22 December 2022 at 18:29

jamesyao created an issue. See original summary.

Comment #2

jamesyao commented 22 December 2022 at 18:47

Version:

1.0.x-dev

» 1.0.0-alpha2

Comment #3

20 January 2023 at 11:13

mohit_aghera made their first commit to this issue’s fork.

Comment #4

20 January 2023 at 11:14

mohit_aghera opened merge request !1

Comment #5

mohit_aghera commented 20 January 2023 at 11:15

Status:

Active

» Needs review

Added permission so that tab is not visible to anonymous users.

Comment #6

jamesyao commented 20 January 2023 at 13:43

Thanks @mohit_aghera. Adding routing permission works to me.

Comment #7

joseph.olstad

French

commented 20 January 2023 at 18:41

Status:

Needs review

» Reviewed & tested by the community

RTBC
Test failure is unrelated to this functionality.

Comment #8

jamesyao commented 23 January 2023 at 15:18

Could someone please approve @mohit_aghera's merge request about adding permission?

Comment #9

jibran

he/him

Urdu

Toronto, Canada

commented 23 January 2023 at 23:44

Can we make the tests green?

Comment #10

joseph.olstad

French

commented 25 January 2023 at 15:32

Parent issue:

» #3336449: Fix webform_revision_ui HEAD tests

@jibran,

I've linked the two related issues. Meanwhile the merge request is still good!

Comment #11

joseph.olstad

French

commented 25 January 2023 at 15:33

please see
#3336449: Fix webform_revision_ui HEAD tests

Comment #12

joseph.olstad

French

commented 25 January 2023 at 15:33

@jibran, please trigger D9.5.x tests with a supported version of PHP

Comment #13

joseph.olstad

French

commented 25 January 2023 at 15:43

Proof that the test fails have nothing to do with the above merge request:

I created a patch to add a README.md, the automated test failed

see results here: the no change patch is the second one from comment #4

I discovered the drupalci.yml was trying to apply a patch that's already been committed to the latest Drupal. A rerolled patch is required for tests to pass with Drupal 9.5.x, I'm testing a possible fix now

#3336449-4: Fix webform_revision_ui HEAD tests

Comment #14

jamesyao commented 25 January 2023 at 15:46

Thanks @joseph.olstad for providing the root of the automation test failure cause about the merge request.

Comment #15

joseph.olstad

French

commented 25 January 2023 at 16:58

Parent issue:	#3336449: Fix webform_revision_ui HEAD tests	» #3145075: Fix HEAD tests for config_revision for D9.5
Related issues:		+#3336449: Fix webform_revision_ui HEAD tests

Comment #16

joseph.olstad

French

commented 25 January 2023 at 17:00

I am stumped why the fails in config_revision and webform_revsion_ui , I necessarily updated the patch for the drupalci.yml to the expected patch but there's still errors. I'd appreciate it if someone else had a look at the config_revision issue

#3145075: Fix HEAD tests for config_revision for D9.5

Comment #17

joseph.olstad

French

commented 17 October 2023 at 02:17

Patch 3328890 from the merge request is still good! Holding status as RTBC

Thanks

Comment #18

12 January 2024 at 12:20

progga made their first commit to this issue’s fork.

Comment #19

12 January 2024 at 12:22

progga opened merge request !2

Comment #20

progga commented 12 January 2024 at 18:51

Status:

Reviewed & tested by the community

» Needs review

Hello,
I am proposing an alternate fix where anybody who has the "view all webform revisions" permission would see its "Revisions" tab.

Change summary:
- New user permissions: view all webform revisions, revert all webform revisions, delete all webform revisions. These permissions provide fine grained access control over Webform revisions compared to the catch all "administer config_revision" permission. An update hook applies these permissions to all roles with the "administer config_revision" permission. This should make code update easier.
- Permission fix for the "Revisions" tab. Associated functional test method.
- Had to add a Gitlab CI file as DrupalCI isn't running for some reason. Gitlab CI test is passing thankfully.
- Gitlab CI seems to require a composer.json file to grab dependencies. So had to add one.
- Some small fixes to cope with coding standard and static analysis checks.

~~Please note that, with this change, just because someone has access to the revision history doesn't mean they could revert them. Please let me know if this approach is acceptable.~~ Thanks.

Comment #21

joseph.olstad

French

commented 30 December 2024 at 21:17

Status:	Needs review	» Postponed
Related issues:		+#3435672: Automated Drupal 11 compatibility fixes for webform_revision_ui

I've put this fix into the Drupal 11 compatibility MR and credited those above in the commit.

Comment #22

joseph.olstad

French

commented 20 January 2025 at 16:23

This is almost ready to go in for the Drupal 11 upgrade except the maintainer has asked for additional tests to be written covering operations based on the given permission.

#3435672: Automated Drupal 11 compatibility fixes for webform_revision_ui

So, needs more tests.