Problem/Motivation

A menu link or link-field item pointing to an entity that belongs to site B is rendered while browsing site A (or the default context). Core runs an access check on the target route; EntityAccessHooks::entityAccess() correctly returns forbidden ("Entity belongs to a different site"), so core drops the link from the menu tree / removes the field link. Result: cross-site links silently disappear ("missing menu links").

Proposed resolution

Site-scoped links already know their target site via the site_id / site URL option (set by SitesLinkitWidgetTrait), and SitesUrlGenerator already produces a correct absolute URL to the target site's hostname. Render these links as external/unrouted absolute URLs so the menu/link access system skips the entity-route access check entirely. EntityAccessHooks stays strict.

Integration points to cover:

  • Link-field formatter: when an item carries site_id for another site, build the link as an external absolute URL.
  • Menu links to site-scoped entities: same treatment so the menu tree keeps them.
  • Active-trail suppression for cross-site links already exists in SitesLinkGenerator.

Issue fork sites-3605518

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

hydra created an issue. See original summary.

harlor’s picture

I think we can live without an access check for links to other sites.

LGTM

valegole’s picture

Status: Needs review » Reviewed & tested by the community

Perfect, thanks

  • hydra committed 7f05d575 on 1.x
    task: #3605518 Menu links / link-field items to entities on another site...
hydra’s picture

Status: Reviewed & tested by the community » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.