By macsim on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
3.0.x
Introduced in version:
3.0.0
Issue links:
Description:
What changed
The Drush generator template routing.yml.twig was generating collection routes with the wrong permission: administer site configuration instead of the module-specific administer subentities.
This has been fixed in the template. New code generated after this fix will use the correct permission.
Why it changed
The generated permission did not match the permission defined in subentity.permissions.yml, which means the collection route was not properly guarded by the Sub Entity access model.
What you need to do
If you generated a sub-entity type before this fix, open your module's routing.yml and update the _permission requirement on the collection route:
Before:
entity.my_entity.collection:
path: '/admin/content/my_entity'
defaults:
_entity_list: 'my_entity'
_title: 'My Entity List'
requirements:
_permission: 'administer site configuration'
After:
entity.my_entity.collection:
path: '/admin/content/my_entity'
defaults:
_entity_list: 'my_entity'
_title: 'My Entity List'
requirements:
_permission: 'administer subentities'
Impacts:
Module developers