Overview

Users without the "administer code components" permission (e.g., Content Creators) can see the Edit Code Component option in the Layers panel, even though they should not have access.

When these users attempt to use this option, they are shown an error message, but the message does not have a close option, and after the error/redirection, the user remains stuck on the same error page.

Expected: The Edit option for code components should not be visible in the Layers panel for users lacking proper permissions. If an error occurs, the message should have a clear close button, and the user should be appropriately redirected.

Steps to Reproduce

  1. Log in as a user role without the "administer code components" permission (e.g., Content Creator).
  2. Ensure there are code components placed on the canvas by an administrator.
  3. Open the Layers panel.
  4. Observe whether the Edit Code Component option is visible for code components.

    Expected: Edit option should NOT be visible.
  5. If the Edit option is visible, click on it.
  6. Observe the error message shown. Notice that:
    • The message does not include an option to close/dismiss it.
    • Even after any redirection, the user remains stuck on the error page.
  7. Expected behavior:
    • Users without "administer code components" permission should not see the Edit option in the Layers panel.
    • If they somehow access it, the error message should have a clear close button and subsequently redirect the user appropriately.

Proposed resolution

User interface changes

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

mayur-sose created an issue. See original summary.

wim leers’s picture

lauriii’s picture

jessebaker’s picture

Assigned: Unassigned » jessebaker

jessebaker’s picture

Assigned: jessebaker » Unassigned
Status: Active » Needs review
jessebaker’s picture

I've not addressed "If they somehow access it, the error message should have a clear close button and subsequently redirect the user appropriately."

The user without permissions should only be able to get to that error screen by typing in the URL. Now that the "Edit code" options is correctly wrapped, I don't think there are any other ways to get there so I don't think it's necessary. They will have to just click the Drop icon in the top left and navigate out of XB entirely (or edit the URL)

wim leers’s picture

Assigned: Unassigned » utkarsh_33
wim leers’s picture

Assigned: utkarsh_33 » mayur-sose

Oops, this is what I meant to do 😅

mayur-sose’s picture

Assigned: mayur-sose » wim leers
StatusFileSize
new109 KB

The reported issue has been resolved. Users without the "administer code components" permission can no longer access the Edit Code button. Thanks @jessebaker and @wim-leers

wim leers’s picture

Assigned: wim leers » Unassigned
Status: Needs review » Reviewed & tested by the community

Lovely, thanks so much!

wim leers’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.