Verified Commit 3c62e4ff authored by Dave Long's avatar Dave Long
Browse files

feat: #3020938 Add view unpublished block content permission 

By: jurgenr
By: acbramley
By: smustgrave
By: pameeela
By: gábor hojtsy
(cherry picked from commit 75becbf6)
parent 14a405c2

core/modules/block_content/block_content.permissions.yml

+4 −0
Original line number Diff line number Diff line
@@ -14,3 +14,7 @@ administer block content: 
  title: 'Administer block content'

  description: 'View, edit and delete all block content regardless of permission restrictions.'

  restrict access: TRUE



view unpublished block content:

  title: 'View unpublished block content'

  description: 'Allows viewing unpublished block content'

core/modules/block_content/src/BlockContentAccessControlHandler.php

+8 −3
Original line number Diff line number Diff line
@@ -61,10 +61,15 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter 
    $access = AccessResult::allowedIfHasPermissions($account, ['administer block content']);

    if (!$access->isAllowed()) {

      $access = match ($operation) {

        // Allow view and update access to user with the 'edit any (type) block

        // content' permission or the 'administer block content' permission.

        // Allow view access if the block is published, or the user has either

        // "access block library" or "view unpublished block content"

        // permissions.

        'view' => AccessResult::allowedIf($entity->isPublished())

          ->orIf(AccessResult::allowedIfHasPermission($account, 'access block library')),

          ->orIf(AccessResult::allowedIfHasPermissions($account, [

            'access block library',

            'view unpublished block content',

          ], 'OR'))

          ->addCacheableDependency($entity),

        'update' => AccessResult::allowedIfHasPermission($account, 'edit any ' . $bundle . ' block content'),

        'delete' => AccessResult::allowedIfHasPermission($account, 'delete any ' . $bundle . ' block content'),

        // Revisions.

core/modules/block_content/tests/src/Functional/Rest/BlockContentResourceTestBase.php

+1 −1
Original line number Diff line number Diff line
@@ -205,7 +205,7 @@ protected function getExpectedUnauthorizedAccessMessage($method) { 
      };

    }

    return match ($method) {

      'GET' => "The 'access block library' permission is required.",

      'GET' => "The following permissions are required: 'access block library' OR 'view unpublished block content'.",

      'PATCH' => "The 'edit any basic block content' permission is required.",

      'POST' => "The following permissions are required: 'create basic block content' OR 'administer block content'.",

      'DELETE' => "The 'delete any basic block content' permission is required.",

core/modules/block_content/tests/src/Kernel/BlockContentAccessHandlerTest.php

+19 −1
Original line number Diff line number Diff line
@@ -212,7 +212,7 @@ public static function providerTestAccess(): array { 
        NULL,

        AccessResultNeutral::class,

      ],

      'view:unpublished:reusable:admin' => [

      'view:unpublished:reusable:library' => [

        'view',

        FALSE,

        TRUE,
@@ -221,6 +221,24 @@ public static function providerTestAccess(): array { 
        NULL,

        AccessResultAllowed::class,

      ],

      'view:unpublished:reusable:unpublished-permission' => [

        'view',

        FALSE,

        TRUE,

        ['view unpublished block content'],

        TRUE,

        NULL,

        AccessResultAllowed::class,

      ],

      'view:unpublished:reusable:admin' => [

        'view',

        FALSE,

        TRUE,

        ['administer block content'],

        TRUE,

        NULL,

        AccessResultAllowed::class,

      ],

      'view:unpublished:reusable:per-block-editor:basic' => [

        'view',

        FALSE,

core/modules/jsonapi/tests/src/Functional/BlockContentTest.php

+1 −1
Original line number Diff line number Diff line
@@ -219,7 +219,7 @@ protected function getPostDocument(): array { 
   */

  protected function getExpectedUnauthorizedAccessMessage($method) {

    return match ($method) {

      'GET' => "The 'access block library' permission is required.",

      'GET' => "The following permissions are required: 'access block library' OR 'view unpublished block content'.",

      'PATCH' => "The 'edit any basic block content' permission is required.",

      'POST' => "The following permissions are required: 'create basic block content' OR 'administer block content'.",

      'DELETE' => "The 'delete any basic block content' permission is required.",