ConfigEntityListController::getOperations adds 'enable' and 'disable' without checking access [#2029319]

Now that we are checking access for CRUD operations #1995048: EntityListController::getOperations() should respect access checks what should we do about the 'enable' and 'disable' operation added in ConfigEntityListController::getOperations(). They are only added if they have a status key in their annotation.

Comment	File	Size	Author
#3	enable-and-disable-access-2029319-3.patch	689 bytes	internetdevels

Comments

Comment #1

tim.plunkett

he/him

English

Philadelphia

commented 27 June 2013 at 06:24

Issue tags:

+Configurables

Tagging.

Comment #2

berdir

German

Switzerland

commented 27 June 2013 at 08:58

Issue tags:

+Novice

I think we should also check for update access there, should be a very simple patch. Have a look at the referenced issue.

Comment #3

internetdevels commented 13 January 2014 at 16:28

Issue summary:	View changes
Status:	Active	» Needs review

Status	File	Size
new	enable-and-disable-access-2029319-3.patch	689 bytes

Added check for update access.

Comment #4

berdir

German

Switzerland

commented 13 January 2014 at 19:12

Yes, something like that. We should probably have some basic test coverage for this, we have a ConfigEntityListTest that we could extend.

The problem is that the ConfigTestAccessController does not implement any access control at all, so we would have to add add/update/delete permissions to config_test.module and check those in the access controller. Then we can check that users can only see the operations they're allowed to by default.