Problem/Motivation

Recurring Events provides permissions for cloning/editing events. When viewing a given series or instance, tabs are shown depending on the associated permission; that's working. However, if you navigate to the Event Series or Event Instances listing pages, the Operations pull down button shows some operations regardless of the permission.

Steps to reproduce

  1. Install and enable the module.
  2. Add a couple of event series (and thus event instances).
  3. Create a role that has access to view the event series and instance overview pages, but does NOT have any create/update/delete/clone permissions for events.
  4. Add a user with that role and log in as that user.
  5. Navigate to the Event Series listing page (/admin/events/series). Observe that the "Clone" and "Add instance" operations are incorrectly shown.
  6. Navigate to the Event Instances listing page (/admin/events/instances). Observe that the "Clone" and "Edit" operations are incorrectly shown.

Proposed resolution

Add permission checks to recurring_events_entity_operation() in recurring_events.module.
Use the 'update' operation instead of the 'edit' operation for checks in EventSeriesAccessControlHandler::checkAccess and EventInstanceAccessControlHandler::checkAccess.

CommentFileSizeAuthor
#2 recurring_events-clone_operations_permissions-3328907-2.patch901 bytesgreggmarshall

Issue fork recurring_events-3328907

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

greggmarshall created an issue. See original summary.

greggmarshall’s picture

greggmarshall
Location Aurora/Denver, Colorado
commented
StatusFileSize
new recurring_events-clone_operations_permissions-3328907-2.patch901 bytes

Patch to implement proposed resolution.

muriqui made their first commit to this issue’s fork.

Made an MR for the patch and also switched the access check to use $entity->access('clone') rather than directly checking a permission.

muriqui opened merge request !64

muriqui’s picture

muriqui commented
Title: Clone Operations Don't Respect Permissions » Entity operations links don't respect permissions
Version: 2.0.0-rc6 » 2.0.x-dev
Issue summary: View changes
Status: Active » Needs work

Setting to "needs work" because the other operations links seem to have similar issues. Testing on a clean install, "Add instance" is shown for series and "Edit" is shown for instances regardless of permission. Also noticed that the entity access control handlers are using the 'edit' operation (it's 'update' for entities), and are allowing access for any unknown operation (should be neutral, I believe). I'm updating the issue description and will continue work on the MR to resolve these.

muriqui’s picture

muriqui commented
Issue summary: View changes
muriqui’s picture

muriqui commented
Issue summary: View changes
muriqui’s picture

muriqui commented
Status: Needs work » Needs review

I think that should do it.

muriqui’s picture

muriqui commented

GroupEventSeriesPermissionProvider::getPermission()'s only function was to change the $operation from 'edit' to 'update', which is unnecessary now because this MR changes recurring_events to use 'update' as expected.

owenbush’s picture

owenbush commented

Thanks for the work on this all. The MR looks good to me and I'll get around to testing it when I have my local dev back up and running.

  • owenbush committed 02901c10 on 2.0.x authored by muriqui 
    Issue #3328907 by muriqui, greggmarshall: Entity operations links don't...

  • owenbush committed 015e7f20 on 8.x-1.x authored by muriqui 
    Issue #3328907 by muriqui, greggmarshall: Entity operations links don't...
owenbush’s picture

owenbush commented
Status: Needs review » Fixed

This has been merged into the latest dev branches, thank you for all the help on this.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.