Overview

On /admin/people/permissions, each "Use the X text format" permission title is a link to that text format's configuration page (route entity.filter_format.edit_form). That page requires the administer filters permission.

A user who can manage permissions (administer permissions) but does not have administer filters sees these links and gets a 403 Access Denied when following one. The link is rendered unconditionally, without checking whether the current user can reach its target.

Steps to reproduce

  1. Create a role with at least these permissions (explicitly no administer filters):
    • access administration pages
    • access navigation
    • view the administration theme
    • administer permissions
    • administer users
  2. Assign the role to a user and log in as that user.
  3. Go to /admin/people/permissions.
  4. Follow a "Use the Restricted HTML text format" permission link.
  5. Result: 403 Access Denied. Expected: no link, or a link the user can follow.

Proposed resolution

In FilterPermissions::permissions(), only wrap the format label in a link when the current user has access to the format's edit form; otherwise show the plain label.

The access check's cacheability to the permission can be ignored, this is in a form forced with max-age 0

User interface changes

For users without administer filters, text format permission titles show as plain text instead of a 403 link.

Disclaimer: Used Claude Code + claude-opus-4-8 to search for potential dupes and write concrete STR.

Issue fork drupal-3616458

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

penyaskito created an issue. See original summary.

penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented
Issue summary: View changes
penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented
Issue summary: View changes

penyaskito opened merge request !16686

penyaskito’s picture

penyaskito
he/him
Primary language Spanish
Location 🧑🏽‍🌾 Seville 💃 Andalusia, UTC+2 🇪🇺
commented
Status: Active » Needs review

Wim Leers flagged this on an internal project, so if possible should get credit too.

csakiistvan’s picture

csakiistvan
Primary language Hungarian
Location Budapest, Hungary
commented
Assigned: Unassigned » csakiistvan
csakiistvan’s picture

csakiistvan
Primary language Hungarian
Location Budapest, Hungary
commented
Assigned: csakiistvan » Unassigned
Status: Needs review » Reviewed & tested by the community

✅ Tested and works — MR !16686.

Environment
  • Drupal: 11.4.4
  • PHP: 8.5.5
  • Database: MariaDB 10.11.16
  • DDEV: v1.25.2
  • Browser: Chrome
Prerequisites
  • A role with access administration pages, access navigation, view the administration theme, administer permissions, administer users — explicitly without administer filters, assigned to a test user (per the issue summary).
  • Test run: vendor/bin/phpunit core/modules/filter/tests/src/Kernel/FilterPermissionsTest.php
Steps
  1. Apply the fix from MR !16686: FilterPermissions::permissions() only links the format label when $format->access('update') is TRUE, plus the new FilterPermissionsTest.
  2. Rebuild caches: ddev drush cr
  3. Log in as the test user, go to /admin/people/permissions and check the Filter section.
  4. Log in as user 1 and check the same section.
  5. Run the new kernel test and the filter kernel suite.
Expected results
  • Without administer filters: the text format permission titles are plain text, no link that would 403.
  • With administer filters: the titles stay linked and the links work.
  • The new kernel test passes and nothing else in the filter suite regresses.
Actual results

Before the fix the test user saw "Use the Restricted HTML text format" as a link and following it returned 403 on /admin/config/content/formats/manage/restricted_html. After the fix the same user sees the plain label with no link, while user 1 still gets a working link. FilterPermissionsTest passes (13 assertions).

Notes
  • The access check matches what the link target requires: for the test user both $format->access('update') and the route access for entity.filter_format.edit_form return FALSE.
  • Re the note about the new test file: no existing test asserts the output of FilterPermissions::permissions(). FilterDefaultConfigTest only mentions the class in a setUp comment and is about default config installation, so a separate FilterPermissionsTest looks like the right home.
  • The filter kernel suite reports 9 errors in EntityLinksTest (Class "ColinODell\PsrTestLogger\TestLogger" not found) — a missing dev dependency in this environment, unrelated to the change.

Testing produced with the assistance of an LLM.

csakiistvan’s picture

csakiistvan
Primary language Hungarian
Location Budapest, Hungary
commented
Status: Reviewed & tested by the community » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work

Left some comments but tests appear to be failing too.