Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.The media library performs a create_access check on the entity level, when selecting or creating a media.
If a user don't have the permission "create $bundle" then, the create_access check failed. The "administer nodes" permission isn't check by the create access method. And then we get this ajax error when selecting a media.
Code de statut HTTP : 403
Informations de débogage ci-dessous.
Chemin : /media-library?ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bcover%5D=cover&media_library_selected_type=cover&media_library_remaining=1&media_library_opener_parameters%5Bfield_widget_id%5D=field_cover&media_library_opener_parameters%5Bentity_type_id%5D=node&media_library_opener_parameters%5Bbundle%5D=page&media_library_opener_parameters%5Bfield_name%5D=field_cover&hash=V2mDIv8jB6JstD5fM0__xRudkjqT62KxWA7EfmmZY_c&views_display_id=widget
StatusText: Forbidden
The relevant issue about Media library which introduce this behavior.
#3038254: Delegate media library access to the "thing" that opened the library
In the case of micro node, users of a micro site can create content, even if they don't have the global permission "create $bundle". So let's provide a create_access hook to handle this use case.
This fix should need probably to be moved on the micro_site module itself to handle create_access for all content entities once content entities will be supported out if the box by micro site.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | 3100098-5.patch | 1.08 KB | flocondetoile |
Comments
Comment #2
flocondetoileComment #3
flocondetoileComment #4
flocondetoileComment #5
flocondetoileComment #6
flocondetoileComment #7
mloyat commentedit works
Comment #9
flocondetoileThanks