Overview

Discovered in #3503412: Allow Content Author to set site's homepage from navigator.

xb_config_entity.edit is incorrect, the operation is 'update', not 'edit'

Per \Drupal\Core\Entity\EntityAccessControlHandler::checkAccess

   * @param string $operation
   *   The entity operation. Usually one of 'view', 'view label', 'update' or
   *   'delete'.

Proposed resolution

Fix routing to use 'update' not 'edit'

User interface changes

Issue fork experience_builder-3535575

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mglaman created an issue. See original summary.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Component: … to be triaged » Internal HTTP API
Priority: Normal » Minor
Issue summary: View changes
Issue tags: +Novice
Related issues: +#3503412: Allow Content Author to set site's homepage from navigator

😱 So why does this even work?! Ah … because we're only special-casing delete, and EVERY OTHER OPERATION, including non-existing ones, get the same treatment.

Simple fix :)

Nice catch!

penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented
Version: 0.x-dev » 1.x-dev
Assigned: Unassigned » penyaskito

penyaskito opened merge request !1327

penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented
Assigned: penyaskito » Unassigned
Status: Active » Needs review

This wasn't covered by tests in DxRouteConsistencyTest, but I don't think having one would prevent this to happen in other route, so not adding any tests.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Title: xb_config_entity has wrong operation, should be 'update' » A few routes use the non-existent `edit` entity operation, should be `update`
Status: Needs review » Reviewed & tested by the community

+1 that tests are overkill here.

As I previously described in the place that originally reported this: this is NOT a security concern because XB's config entity access control handlers special-cased the view and delete operations and deferred ALL OTHER operations (including non-existent ones) to the same logic: check if the current user has the config entity type's "admin" permission. 👍

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Reviewed & tested by the community » Fixed

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.