Problem/Motivation
The pagedesigner media submodules use the media bundle ids to provide media entries to the pagedesigner asset manager using views. The bundle id requires the "administer media types" permission, which might present a security issue.
Using a custom field formatter, the media modules could display the bundle ids using the view label permission.
Proposed resolution
- Add a new formatter based on EntityReferenceIdFormatter from core and overwrite the checkAccess method to use the "view label" permission.
- Update hook to set the new formatter on the media bundle id reference field in the pagedesigner media views.
- Update supplied config in the media modules to use the new formatter.
User interface changes
None
API changes
- The default views of pagedesigner will use the new formatter for the media bundle id for the media bundle id reference field.
Data model changes
None
Issue fork pagedesigner-3390557
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
pvbergen commentedComment #4
pvbergen commentedComment #5
pvbergen commentedComment #6
pvbergen commentedComment #8
pvbergen commented