0

I want to restrict the editing of a block to users whom have X or Y permissions.

I have tried access arguments and access callback.

function MYMODULE_menu_alter(&$items) {
  $items['admin/structure/block/manage/block/72/configure']['access arguments'] = ['X']; // ['X','Y'] uses AND not OR :(
}

I've attempted to add the 'Or' logic via a access callback function instead.

function _banner_block_access() {
    return user_access('X') || user_access('Y');
}

/**
 * Implements hook_menu_alter().
 */
function MYMODULE_menu_alter(&$items) {
  $items['admin/structure/block/manage/block/72/configure']['access callback'] = '_banner_block_access';
}

The problem

When the user has the correct permissions, they should see the block edit admin form.

What actually happens is the path /admin/structure/block/manage/block/72/configure shows the block index listing (/admin/structure/block) instead.

When the user doesn't have the right permission, a non authorised error is correctly displayed.

When the function returns false the view is correct and displays a not authorised message.

Is this a Drupal bug or am I doing something wrong?

1 Answer 1

0

None of the Drupal core modules defines a route for admin/structure/block/manage/block/72/configure.

The block module has a route for admin/structure/block/manage/%/%/configure, but since that is a default tab, it inherits its access permissions from its parent route, admin/structure/block/manage/%/%.

The correct code to alter that route would be similar to the following one.

/**
 * Implements hook_menu_alter().
 */
function mymodule_menu_alter(&$items) {
  if (isset($items['admin/structure/block/manage/%/%'])) {
    $items['admin/structure/block/manage/%/%']['access callback'] = '_banner_block_access';
    $items['admin/structure/block/manage/%/%']['access arguments'] = array(4, 5);
  }
}

function _banner_block_access($module, $block) {
  if ($module == 'block' && $block == 72) {
    return user_access('X') || user_access('Y');
  }

  // Use the default access for the other blocks.
  return user_access('administer blocks');
}
1
  • Thank you very much. That makes perfect sense; however, I did still need to add /configure onto the end of /%/% for it to work. Sep 26, 2022 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.