Commit 723e5ea5 authored by alexpott's avatar alexpott

Issue #2172973 by tim.plunkett: Ensure ConfigEntities providing a list...

Issue #2172973 by tim.plunkett: Ensure ConfigEntities providing a list controller use admin_permission.
parent d017695d
......@@ -56,7 +56,7 @@ public static function createInstance(ContainerInterface $container, EntityTypeI
*/
protected function checkAccess(EntityInterface $entity, $operation, $langcode, AccountInterface $account) {
if ($operation != 'view') {
return $account->hasPermission('administer blocks');
return parent::checkAccess($entity, $operation, $langcode, $account);
}
// Deny access to disabled blocks.
......
......@@ -29,6 +29,7 @@
* }
* },
* config_prefix = "block.block",
* admin_permission = "administer blocks",
* fieldable = FALSE,
* entity_keys = {
* "id" = "id",
......
......@@ -31,9 +31,8 @@ public function checkAccess(EntityInterface $entity, $operation, $langcode, Acco
// the personal contact form.
return $account->hasPermission('administer contact forms') && $entity->id() !== 'personal';
}
else {
return $account->hasPermission('administer contact forms');
}
return parent::checkAccess($entity, $operation, $langcode, $account);
}
}
......@@ -28,6 +28,7 @@
* }
* },
* config_prefix = "contact.category",
* admin_permission = "administer contact forms",
* bundle_of = "contact_message",
* entity_keys = {
* "id" = "id",
......
......@@ -30,6 +30,7 @@
* "storage" = "Drupal\Core\Config\Entity\ConfigStorageController"
* },
* config_prefix = "filter.format",
* admin_permission = "administer filters",
* entity_keys = {
* "id" = "format",
* "label" = "name",
......
......@@ -31,7 +31,7 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A
return FALSE;
}
if ($operation != 'view' && $account->hasPermission('administer filters')) {
if ($operation != 'view' && parent::checkAccess($entity, $operation, $langcode, $account)) {
return TRUE;
}
......@@ -41,11 +41,4 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A
return !empty($permission) && $account->hasPermission($permission);
}
/**
* {@inheritdoc}
*/
protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {
return $account->hasPermission('administer filters');
}
}
......@@ -25,10 +25,11 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A
return TRUE;
}
// Locked date formats cannot be updated or deleted.
if (in_array($operation, array('update', 'delete')) && $entity->isLocked()) {
elseif (in_array($operation, array('update', 'delete')) && $entity->isLocked()) {
return FALSE;
}
return user_access('administer site configuration', $account);
return parent::checkAccess($entity, $operation, $langcode, $account);
}
}
......@@ -34,6 +34,7 @@
* "label" = "label",
* "uuid" = "uuid"
* },
* admin_permission = "administer site configuration",
* links = {
* "edit-form" = "system.date_format_edit"
* }
......
......@@ -21,6 +21,7 @@
* "access" = "Drupal\system\MenuAccessController"
* },
* config_prefix = "system.menu",
* admin_permission = "administer menu",
* entity_keys = {
* "id" = "id",
* "label" = "label",
......
......@@ -23,23 +23,12 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A
if ($operation === 'view') {
return TRUE;
}
elseif ($operation == 'delete') {
// Locked menus could not be deleted.
if ($entity->isLocked()) {
return FALSE;
}
// Locked menus could not be deleted.
elseif ($operation == 'delete' && $entity->isLocked()) {
return FALSE;
}
if (in_array($operation, array('update', 'delete'))) {
return $account->hasPermission('administer menu');
}
}
/**
* {@inheritdoc}
*/
protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {
return $account->hasPermission('administer menu');
return parent::checkAccess($entity, $operation, $langcode, $account);
}
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment