Problem/Motivation
The current access check implemented on SystemAdminMenuBlockAccessCheck doesn't work if the configured menu item uses the attribute url.
Steps to reproduce
- Install the latest Drupal version.
- Create a module
test_linkand implement the following route ontest_link.routing.yml:
test_link.admin: path: "/admin/test-link" defaults: _controller: '\Drupal\system\Controller\SystemController::systemAdminMenuBlockPage' _title: "Test Link" requirements: _permission: "access content" - Implement the following menu links on `test_link.links.menu.yml`:
test_link.admin: title: "Test Link Admin" route_name: "test_link.admin" parent: system.admin_content test_link.admin.content: title: "Content List" url: "internal:/admin/content" description: "Content listing" parent: test_link.admin - Enable the module
- With an admin user, access the page
/admin/test-link
Proposed resolution
We need to check if the menu link doesn't have a route associated with it and implement a logic to validate the cases where the link has the url attribute.
Remaining tasks
Implement the new logic;
Implement the automated tests;
User interface changes
N/A
Introduced terminology
N/A
API changes
N/A
Data model changes
N/A
Release notes snippet
N/A
| Comment | File | Size | Author |
|---|---|---|---|
| #12 | image (1).png | 122.1 KB | joaopauloc.dev |
| #12 | image.png | 118.91 KB | joaopauloc.dev |
| #8 | access-denied.png | 180.63 KB | joaopauloc.dev |
| #8 | ok.png | 171.12 KB | joaopauloc.dev |
| #5 | image (1).png | 143.91 KB | joaopauloc.dev |
Issue fork drupal-3522754
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3522754-access-to-systemadminmenublockpage
changes, plain diff MR !12039
Comments
Comment #3
hfernandes commentedComment #4
hfernandes commentedComment #5
joaopauloc.dev commentedI can confirm that the fix works.
I followed these steps.
Install Drupal 11
Create a custom module test link
Create the route and the menu link files as mentioned above.
Enabled the module.
Access the following url: /admin/test-link
Without the fix, I couldn't access the page.


After the fix was applied, I could access it.
Comment #6
catchOne comment on the MR.
Comment #7
hfernandes commentedComment #8
joaopauloc.dev commentedI confirm that after the code review changes the issue still fixed.
Same steps followed of comment #5
Access denied in without the fix.


Could access with the fix applied.
Comment #9
alexpottThis looks nearly ready - I think we can use API rather than exceptions to skip unrouted routes in the child link checking...
Comment #10
alexpottComment #11
hfernandes commentedComment #12
joaopauloc.dev commentedI confirmed that still working.


Without the fix getting access denied.
With fix applied.
Comment #15
catchThis looks good now. Committed/pushed to 11.x and cherry-picked to 11.2.x, thanks!