Hide non authorized menu items

Hello. Are you sure this is related to Admin Toolbar ? Does the Report shows up if Admin Toolbar is uninstalled ?

As we do not work on anything about the "Report" part, I doubt that Admin Toolbar is responsible of this.

Reports are gone, core toolbar removes everything it can't access.
So yeah it would be nice to fix this.

The documentation isn't clear, but the Admin Toolbar is filtering menu items by access rights. I had the same issue. I dug into the code and realized my problem was due to adding too many permissions to my user role.

Specifically, look at the following two permission sets:

1) "Link to any page" - Drupal core sees this and throws up a green access flag to any link. When the permissions check happens at menu build time, it then opens up every menu item. Make sure you have this un-checked if you want the role to have limited visibility.

2) "Use the administration pages and help" - if you have this checked then the help menu item and the clear cache links will show. Also, it will load the config item (even though your user will not have access to many of the links).

Once I removed the above two permission sets, the menu worked properly for my editors. I suggest that the maintainers of this module make that a little clearer up front.

Otherwise, this is a great module and I really appreciate the time put into it.

Thanks!
Mike

I have this same problem, especially for the 'Configuration' menu. I have a role which only has access to the URL Aliases but when hovering over the 'configuration' menu item the dropdown shows all the items. Clicking on one of them shows the 'access denied' page but these items shouldn't be listed.

If you uninstall Admin Toolbar, the menu is correct and the items do not show (to be tested in responsive mode to see the menu chidren) ?

Hi @eme,

Arh interesting. I uninstalled the admin_toolbar module and when viewing the menu on the left hand side the Configuration menu does still show all the links. So is this pointing to it being a core toolbar permissions issue presumably?

Thanks
Mike

Seems so... If anybody can seach whether the bug is already in toolbar.module component and close this issue.

I don't think core or admin_toolbar should hide buttons like "Configuration" if a user doesn't have access to any of the underlying sub items.

I've done some testing and with only core toolbar enabled, when a user can see links (like "structure", "configuration" etc.) but hasn't access to anything underneath it the user simply gets the text "You do not have any administrative items." to see when he clicks on one of those links.
With admin_toolbar enabled however you do get to see all the sub items pop out when you hover over "Configuration" for example. Which is bad UX as you get an access denied error page if one tries to click on it.

So I'm still in favor of an extra check to see if the menu item should be added to the tree or not. Which isn't an issue in core because it doesn't give the possibility to see the underlying menu items.

In #6 it was suggested to disable the permission "Use the administration pages and help". I've tried that but this adds side-effects I don't want for my users:

1. It disables the select field "Administration pages language" on the user profile edit page, which my users need to set their preferred language for the back-end.
2. It also removed the menu button to manage "Taxonomy" which my users do have access to.

Also I don't see a reason why a user should lose his permission to see admin pages and help in order to be able to hide some menu items from him.

So, imho this IS an issue that can only be fixed from within admin_toolbar.

I ended up disabling "Link to any page" permissions for my editors, but keeping 'Use the administration pages and help' enabled.

If I disabled 'Use the administration pages and help', a bunch of menu items disappear, even ones my editors should have access to (blocks, taxonomy, ..).
With "Link to any page" enabled, editors still see the Configuration tab and immediate sub items (Development, Media etc), but if they click any of those they will see "You do not have any administrative items." Not sure why that config menu is showing.

I must concur with @hatznie, this cannot be solved by adjusting permissions alone, and some sort of fix is needed within admin_toolbar.

This looks to be a duplicate of #2673914: Only show admin menu items with available Configuration pages according to permissions where it was decided this is an issue in core. FWIW.

I do agree with that. This is a core issue unfortunately...