Problem/Motivation
If you have some pages in your menu that are unpublished, and they have child links, making changes to the menu order in the menu admin page results in the child links moving to the top level of the menu if the node is then saved by a user without menu admin permissions.
I wasn't able to reproduce this when all pages were published.
There are quite a few ways to reproduce this but here is an example in vanilla Drupal 8.7.1:
Screenshot of the menu admin page:
Screenshot after admin makes changes in menu admin page (move Article 2 to be a child of Article 1):
Screenshot of the menu after Article 5 was saved by a user without administer menus:
Steps to reproduce:
- Create user with permission to edit content but without permission to administer menus
- As admin user, create some published and unpublished pages and add them to the menu with varying levels
- Re-parent one of the links that has children
- Edit one of the children
- See the edited node moves to the top level of the menu
Proposed resolution
Remaining tasks
User interface changes
API changes
Data model changes
Release notes snippet
Comment | File | Size | Author |
---|---|---|---|
#4 | 30597890.patch | 1.15 KB | larowlan |
Screenshot 2019-06-06 11.13.53.png | 16.51 KB | pameeela | |
Screenshot 2019-06-06 11.14.51.png | 16.58 KB | pameeela | |
Screenshot 2019-06-06 11.14.14.png | 16.74 KB | pameeela |
Comments
Comment #2
pameeela CreditAttribution: pameeela as a volunteer commentedComment #3
pameeela CreditAttribution: pameeela as a volunteer commentedComment #4
larowlanI think the issue is caused by
\Drupal\Core\Menu\MenuParentFormSelector::getParentSelectOptions
which includes a call to
\Drupal\Core\Menu\DefaultMenuLinkTreeManipulators::checkNodeAccess
which removes nodes the user has no access to from the parent list.A possible solution would be for
\Drupal\Core\Menu\MenuParentFormSelector::parentSelectOptionsTreeWalk
to instead show these items as redacted as per the attached patch.Comment #5
amateescu CreditAttribution: amateescu for Pfizer, Inc. commentedCan we use
- Restricted access -
to match\Drupal\Core\Entity\Element\EntityAutocomplete::getEntityLabels()
?Otherwise I think the patch looks good :)
Comment #9
pameeela CreditAttribution: pameeela as a volunteer commentedJust found #2807629: Allow menu items which link to unpublished nodes to be selected in the parent item selector which is older and has more progress, so I'll close this.