Overview
Users without the "administer code components" permission (e.g., Content Creators) can see the Edit Code Component option in the Layers panel, even though they should not have access.
When these users attempt to use this option, they are shown an error message, but the message does not have a close option, and after the error/redirection, the user remains stuck on the same error page.
Expected: The Edit option for code components should not be visible in the Layers panel for users lacking proper permissions. If an error occurs, the message should have a clear close button, and the user should be appropriately redirected.
Steps to Reproduce
- Log in as a user role without the "administer code components" permission (e.g., Content Creator).
- Ensure there are code components placed on the canvas by an administrator.
- Open the Layers panel.
-
Observe whether the Edit Code Component option is visible for code components.
Expected: Edit option should NOT be visible. - If the Edit option is visible, click on it.
-
Observe the error message shown. Notice that:
- The message does not include an option to close/dismiss it.
- Even after any redirection, the user remains stuck on the error page.
-
Expected behavior:
- Users without "administer code components" permission should not see the Edit option in the Layers panel.
- If they somehow access it, the error message should have a clear close button and subsequently redirect the user appropriately.
Proposed resolution
User interface changes
| Comment | File | Size | Author |
|---|---|---|---|
| #10 | Screenshot 2025-07-10 at 3.59.19 PM.png | 109 KB | mayur-sose |
| Screenshot 2025-07-09 at 3.01.33 PM.png | 96.93 KB | mayur-sose | |
| Screenshot 2025-07-09 at 2.29.33 PM.png | 180.91 KB | mayur-sose |
Issue fork experience_builder-3535142
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
wim leersThanks, this is something we missed in #3516641: Make the XB UI show only UI elements/operations available to the current user!
Comment #3
lauriiiComment #4
jessebaker commentedComment #6
jessebaker commentedComment #7
jessebaker commentedI've not addressed "If they somehow access it, the error message should have a clear close button and subsequently redirect the user appropriately."
The user without permissions should only be able to get to that error screen by typing in the URL. Now that the "Edit code" options is correctly wrapped, I don't think there are any other ways to get there so I don't think it's necessary. They will have to just click the Drop icon in the top left and navigate out of XB entirely (or edit the URL)
Comment #8
wim leersComment #9
wim leersOops, this is what I meant to do 😅
Comment #10
mayur-sose commentedThe reported issue has been resolved. Users without the "administer code components" permission can no longer access the Edit Code button. Thanks @jessebaker and @wim-leers
Comment #11
wim leersLovely, thanks so much!
Comment #13
wim leers