Problem/Motivation

The entity.oembed_provider.add_form route requires a permission explicitly.
It is a better practice to use the _entity_create_access requirement, this way access can be altered with hook_entity_create_access.

Steps to reproduce

Add this hook:

/**
 * Implements hook_entity_create_access().
 */
function test_entity_create_access() {
  return AccessResult::forbidden();
}

You can still create oEmbed providers.

Proposed resolution

Replace the _permission requirement with _entity_create_access.

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork oembed_providers-3584283

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

chris burge made their first commit to this issue’s fork.

chris burge opened merge request !29

chris burge’s picture

chris burge commented
Category: Bug report » Feature request
Status: Active » Needs review

@prudloff - Can you try MR29?

prudloff’s picture

prudloff commented
Status: Needs review » Needs work

The MR adds an access control handler but does not use it in oembed_providers.routing.yml.

I think it should be something like this (untested):

entity.oembed_provider.add_form:
  path: '/admin/config/media/oembed-providers/custom-providers/add'
  defaults:
    _entity_form: 'oembed_provider.add'
    _title: 'Add custom oEmbed provider'
  requirements:
    _entity_create_access: 'oembed_provider'

entity.oembed_provider.edit_form:
  path: '/admin/config/media/oembed-providers/custom-providers/{oembed_provider}/edit'
  defaults:
    _entity_form: 'oembed_provider.edit'
    _title: 'Edit custom oEmbed provider'
  requirements:
    _entity_access: 'oembed_provider.update'

...
chris burge’s picture

chris burge commented
Status: Needs work » Needs review

MR is updated

chris burge’s picture

chris burge commented

Manual testing is successful: hook_entity_create_access() and hook_entity_access() are now able to alter entity access. Test coverage includes permissions, and tests pass.

  • chris burge committed ee462564 on 2.x 
    Resolve #3584283 "Entity.oembedprovider.addform route should"
chris burge’s picture

chris burge commented
Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.