I've implemented hook_entity_field_access like this:

function opencase_entity_field_access($operation, \Drupal\Core\Field\FieldDefinitionInterface $field_definition, $account, $items = NULL) {
  if ($field_definition->getName() == 'field_linked_opencase_actor' && $operation == 'edit') {
    error_log($account->hasPermission('administer users'));
    return AccessResult::allowedIfHasPermission($account, 'administer users');
  return AccessResult::neutral();

When I log is as a user without the "administer users" permission and I go to the edit page containing that field, I get a 'PHP message: \n', in the error log showing that the if-block has been reached and that the user does not have the permission. But the field still appears! If I return an AccessResult::forbidden, however, it works as expected. Any ideas why allowedIfHasPermission doesn't?



Creates an allowed access result if the permission is present, neutral otherwise.

If access is allowed somewhere else, a failed check for the permission doesn't prevent access, because it creates a neutral result.

As you found out you probably need to build a forbidden access result.

| improve this answer | |
  • Thankyou, this makes perfect sense. I was thinking it meant "if and only if". – naomi Jul 18 '18 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.