Drupal core allows access to /admin/people/create based on the permission 'administer users'. This is correct by default, in vanilla core. However it ignores any code that has implemented hook_entity_create_access.

This issue is a blocker for contrib module Administer Users by Role.

Steps to reproduce

  • Create a custom modules that implements hook_entity_create_access as below (plus XXX.permissions.yml to define the new permission).
  • Create a user with permission 'create users' and log on as that user.
  • Visit /admin/people/create
  • Expected behaviour: can access page.
  • Actual behaviour: access denied.
function XXX_entity_create_access(AccountInterface $account, array $context, $entity_bundle) {
  if ($context['entity_type_id'] != 'user') {
    return AccessResult::neutral();
  }

  return AccessResult::allowedIfHasPermission($account, 'create users');
}

Resolution

If the requirement is changed to _entity_create_access: 'user' it works perfectly. The new code is consistent with a variety of other places in Drupal Core.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

AdamPS created an issue. See original summary.

AdamPS’s picture

idebr’s picture

Status: Active » Needs review
AdamPS’s picture

The patch here is currently also included in a patch on #2854252: User forms broken for admin without 'administer users' and that patch includes tests. I could bring the tests back here if there is a desire to check this is separately. Or we could focus our efforts on the other issue and check it all in together.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

AdamPS’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.