The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem/Motivation
Users that do not have the "administer field inheritance" permission see the "Enable inheritance for this entity?" option when editing an entity/bundle that is allowed to have field inheritance, allowing any user with edit permission to configure field inheritance. That option should be limited to users whose roles have the "administer field inheritance" permission.
Steps to reproduce
- Enable the field inheritance module and configure an entity/bundle to allow field inheritance (we noticed the issue using Recurring Events).
- Add a role that does NOT include the "administer field inheritance" permission, but does have permission to create or edit the entity/bundle configured above, and log in as a user with only that role.
- Navigate to, and edit, an entity/bundle that has allow field inheritance enabled
- Note the presence of the Field Inheritance fieldset with the "Enable inheritance for this entity?" option.
Proposed resolution
Check for the permission in field_inheritance_form_alter and return without altering the form if the user doesn't have the permission.
Remaining tasks
User interface changes
API changes
Data model changes
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | field_inheritance-enforce_permission_entity_form-3330386-2.patch | 570 bytes | greggmarshall |
Comments
Comment #2
greggmarshallPatch to check permissions during field_inheritance_form_alter
Comment #3
owenbush commentedThanks for the patch, I'm marking it as needs review so I can get back to it when I have a working local dev again.
Comment #6
owenbush commentedThis looked good to me, thank you for the patch. The only change I made was to move the permission check to the top of the form alter, to stop us having to do any unnecessary lookups if users do not have access.