Entity Query access control to decide if users can reference content. #319
Conversation
#216 (comment) Adds tests. I think they're failing, because I think they do get the content in the list.
|
This is what I am seeing with this patch. Testing with an unpublished landing page Before: Editor cannot reference unpublished landing pages. After: Unpublished landing page appears in drop down autocomplete. And I can link on the landing page. |
|
What the tests are at least failing on is that users that don't have the permission to see the unpublished content also see it. |
|
@ekes ok, looking at that. I took away the editors view any unpublished content and checked again, whilst they can't see the unpublished landing page, it still appears in the list. |
|
I think the patch we may have added Users without 'bypass node access' permission can't reference unpublished content even if they have access to it might be causing a conflict with this. Maybe the safer option is to leave the existing code but add a check for hasPermission('view any unpublished content') alongside the checks for node acesss? |
|
Interesting that whilst I could save it, going back to the edit page gave me this.... (Parent is now restricted access). |
|
Just noting that a similar fix was committed for menu items in Drupal 10.1 so whilst I don't know why |
…blished permission In the entity reference service selector. Restore previous node_access checking, and restrict to published nodes if the checks do not pass. Additionally, check if the user has permission view any unpublished content and allow access to unpublished nodes if that is the case.
andybroomfield
force-pushed
the
fix/2.x/216-admin-unpublished-access
branch
from
e1f27f3 to
ef6e1db
Compare
…ionshipsUi Apply same limit to the widget used to find referenced child pages.
andybroomfield
force-pushed
the
fix/2.x/216-admin-unpublished-access
branch
from
2ed8dc8 to
7023a20
Compare
|
@ekes I've tried to restore the previous logic and add the permission check for 'view any unpublished content' but that seems to have made the tests fail. From manually testing though it appears to be functional, with unpublished landing / service pages hidden if the user does not have any of the right access permissions. |
#216 (comment)
Adds tests. I think they're failing, because I think they do get the content in the list.
Pushing for work done. @andybroomfield