Problem/Motivation

The search form at Content » Search and replace always shows "To configure settings go to Search and Replace Scanner configuration". Users with "Perform search only" or "Perform search and replace" can use the search form, but the configuration page requires "Administer scanner settings". Users without that permission get a link to a page that returns "Access denied".

The same applies to the message shown when no fields have been configured: "The search fields were not configured. To configure them go to Search and Replace Scanner configuration".

Steps to reproduce

1. Create a role with "Perform search and replace" (or "Perform search only") but not "Administer scanner settings", and log in as a user with that role.
2. Go to Content » Search and replace (/admin/content/scanner).
3. The form shows "To configure settings go to Search and Replace Scanner configuration".
4. Following the link gives "Access denied".

Proposed resolution

Check whether the current user can access the configuration page, and only link to it if they can.

Remaining tasks

- Merge request with the fix.
- Test coverage: build the search form as a user with and without "Administer scanner settings", with fields configured and with none.
- Review.

User interface changes

Users without "Administer scanner settings" no longer see the link to the configuration page.

API changes

None.

Data model changes

None.

Issue fork scanner-3625996

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

john.oltman created an issue. See original summary.

john.oltman opened merge request !118

john.oltman’s picture

john.oltman commented
Status: Active » Needs review

The MR is failing tests but in places unrelated to the new code, so I believe there may be an upstream issue. Hopefully resolves on its own. For now putting into review.

smustgrave’s picture

smustgrave commented

I'd pause on MRs..something in twig broke all render #3625969: Twig's 3.30 TypeError: Twig\Runtime\EscaperRuntime::escape(): Argument #4 ($autoescape) must be of type bool, null given

smustgrave’s picture

smustgrave commented

Was this AI generated?

john.oltman’s picture

john.oltman commented

AI generated, I reviewed it though - closely. I especially lean on AI to generate the tests, which it can do much faster than me.

  • smustgrave committed 9f61228e on 2.0.x 
    feat: #3625996 Search form links to settings page for users without...
smustgrave’s picture

smustgrave commented
Status: Needs review » Fixed

This is one I'm fine with skipping tests as it's minor to me. But I'd review the tests more from AI these look to be more complex then they needed to be.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

smustgrave’s picture

smustgrave commented
Category: Feature request » Bug report

This seemed like a bug to me.