I have an entityqueue, Practitioners, and have granted manipulate permissions to a role called Content Admin.

On the /admin/structure/entityqueue page, the user can see the queue. There is an Edit Items button, but in the dropdown attached to the Edit button, they can also see Disable. When clicking this button, it spins for a while then stops. The queue is not disabled.

It seems logical to me that if the user cannot disable an entityqueue, they should not see a Disable option when manipulating the queue.

The Disable option should therefore be removed for any user that doesn't have permission to Disable a queue. I'm guessing that this would normally only be available to users with the Administer Entityqueue permission.

Comments

millionleaves created an issue. See original summary.

sagesolutions’s picture

sagesolutions commented

Some more context:

I setup a role with only the ability to manipulate my queue. "Manipulate First Entity Queue queue"

With this checked, they cannot go to /admin/structure/entityqueue (Access Denied)

They can go to /admin/structure/entityqueue/first_entity_queue/first_entity_queue and add/edit the queue items.

If I add the permissions "Manipulate queues - Access the entityqueues list.", they can then go to /admin/structure/entityqueue

If they click on "Disable", the logs report an access denied message, but nothing is shown to the user.

Looking into it, it look like this is caused by ListBuilders do not check $entity->access() for operation links

sagesolutions’s picture

sagesolutions commented
Related issues: +#2650898: ListBuilders do not check $entity->access() for operation links

I can confirm, that after applying the https://www.drupal.org/files/issues/2650898-6-check_operation_access.patch patch, users with "Manipulate queues - Access the entityqueues list." can view the lists, and cannot see the "disable" option under the operations column.

sagesolutions’s picture

sagesolutions commented
Status: Active » Closed (duplicate)