2

My entity defines an access control handler (a subclass of \Drupal\Core\Entity\AccessControlHandlerInterface) as well as a delete form (a subclass of \Drupal\Core\Entity\EntityConfirmFormBase).

The access handler designates certain entities as uneditable, and returns \Drupal\Core\Access\AccessResult::forbidden() on the "update" and "delete" operations for those entities.

This has the correct effect of hiding the "Edit" and "Delete" operation from the entity list.

Unfortunately, it doesn't do the same when visiting the forms directly via their URLs.

What am I doing wrong here? How do I actually block access to the forms?

Edit: The 404 was because I had the wrong URL for the edit form; turns out it's actually for all operations.

Do I need to call $this->entity->access($this->operation) myself in buildForm()?

2
  • 1
    In your delete route add _entity_access: yourentity.delete to the route requirements.
    – user21641
    Dec 6, 2015 at 20:02
  • Welcome to Drupal Answers! We cannot say what is wrong in code without seeing it. Drupal access control works even if you directly access the URL; it was always so.
    – apaderno
    Dec 6, 2015 at 21:44

1 Answer 1

2

In your delete route add _entity_access: yourentity.delete to the route requirements.

As Ivan pointed out in the comment, this is a matter of the route not automatically requiring entity access when it points at an entity form. The entity access requirement must be added to the route explicitly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.