Problem/Motivation

When you create a new page from template whatever the source node is becomes blocked to anonymous users.

If you use the homepage you will lock yourself out of your site until the template is deleted.

Steps to reproduce

Create a new page from template
While not logged in try and visit the source page. We received Access Denied even though the source was page.
I could still access the source page while logged in but why would the source permissions change?

Even publishing the new page that was just cloned can't be accessed.

Using Drupal 9.2.4
PHP 8.0.9

This makes the module unusable as it crashes the site.

In the logs we saw
Error = InvalidArgumentException: No check has been registered for template_entities.access_check.entities in Drupal\Core\Access\CheckProvider->loadCheck() (line 97 of /home/site/wwwroot/core/lib/Drupal/Core/Access/CheckProvider.php).

Warning = Path: /our-mission/about-this-website. Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException: in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 117 of /home/site/wwwroot/core/lib/Drupal/Core/Routing/AccessAwareRouter.php).

Believe the issue is in EntityAccessCheck.php

Comments

smustgrave created an issue. See original summary.

smustgrave’s picture

smustgrave commented
Issue summary: View changes
chaps2’s picture

chaps2 commented

Hi,

The behaviour you are seeing is by design. Entities used as templates are just for that purpose and will only be visible to roles with the view templates permission. However, the error shouldn't occur so I'll leave this open for now.

Andy

smustgrave’s picture

smustgrave commented

Sorry for the delay.

So if the user creates a clone from a source node. That source is now blocked to all users even though before the clone happened that page was accessible by all. Not sure if that's right?

Also if a user has permissions to view a particular content type, Basic page for example, and they create a clone from a Basic page source. Shouldn't the existing permissions allow them to view that clone since it's also a Basic page?

smustgrave’s picture

smustgrave commented

So our team had to pull this module out of the site to avoid incidentally bringing the site down again. But this is 100% a module we want to use.

This sprint or next our team may look into pulling out the permissions that are applied to the source and cloned entities as the default content type permission should be used in our minds.

Is there something we are missing by chance?