Problem/Motivation

Currently, domain_entity_entity_create_access checks domain entity create access permission even for entity types that are not enabled for domain access checks.

Steps to reproduce

1. With the superadmin user, go to /admin/people/role-settings and set it to none
2. Install the domain_entity module.
3. Add a domain record on /admin/config/domain
4. Create a user with an admin role and set "Domain Access" to the domain created in step 3.
5. Add permission "Create any content on assigned domains" to the administrator. NOTE: "Administer users" permission should still be unchecked.
6. Log in with those created users.
7. Open /admin/people/create

Proposed resolution

Return AccessResult::neutral() in case the target entity type is not enabled in: domain_entity_allowed_entity_types

Additionally

Check that similar behaviour exists on domain_entity_entity_access update/delete operation

CommentFileSizeAuthor
#6 Screenshot from 2026-04-02 18-25-33.png65.82 KBhfernandes
#6 Screenshot from 2026-04-02 18-22-16.png41.76 KBhfernandes

Issue fork domain_entity-3582780

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

vitaliyb98 created an issue. See original summary.

vitaliyb98’s picture

vitaliyb98 commented
Issue summary: View changes

vitaliyb98 opened merge request !36

vitaliyb98’s picture

vitaliyb98 commented

NOTE: failed pipelines were fixed in: https://www.drupal.org/project/domain_entity/issues/3570727#comment-1652...

vitaliyb98’s picture

vitaliyb98 commented
Status: Active » Needs review

IMHO: If a user has the "Create any content on assigned domains" permission, they can create entities within their assigned domains even without the "Administer users" permission.

While this behavior is expected, it would be helpful to document it clearly in the module documentation or on the project page, as it may not be obvious to users.

hfernandes’s picture

hfernandes commented
StatusFileSize
new Screenshot from 2026-04-02 18-22-16.png41.76 KB
new Screenshot from 2026-04-02 18-25-33.png65.82 KB

Hi @vitaliyb98,

I can confirm this patch is working. A Content Editor without the "Administer User" permission isn't able to access the /admin/people/create.

Before:
Before patch
After:
After patch

Regarding your comment about the "Create any content on assigned domains" permission, since the Domain module defines this permission and it only grants access to node content (see DomainAccessNodeHooks.php), I don't think we can use it to bypass access checks for other entity types in this module.

hfernandes’s picture

hfernandes commented
Status: Needs review » Reviewed & tested by the community

bohart made their first commit to this issue’s fork.

bohart’s picture

bohart
Location Lutsk, Ukraine
commented
Version: 8.x-1.x-dev » 2.0.x-dev

  • bohart committed 7a454a3d on 2.0.x authored by vitaliyb98 
    feat: #3582780 Access check applied to unsupported entity types

By:...
bohart’s picture

bohart
Location Lutsk, Ukraine
commented
Assigned: vitaliyb98 » Unassigned
Priority: Normal » Major
Status: Reviewed & tested by the community » Fixed

This one has been merged into a brand-new 2.0.x-dev branch, and will be part of the next release.
Marked as fixed, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

andypost’s picture

andypost
he/him
Primary language Russian
commented

Makes sense to create new release

bohart’s picture

bohart
Location Lutsk, Ukraine
commented

@andypost, yes, and this is our plan for the next week!

We have already cleaned up about 50% of the outdated issues and merge requests, and reviewed/tested/committed RTBC ones.
The plan is to finish the cleanup, retest everything, and release a new version of the module.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.