Skip to content

Security model

Use Display Builder

To use a Display Builder instance, an user role needs at least 2 permissions:

  • The specific permission to use the Display Builder profile associated to the instance
  • The permission related to the display we are building:
  • entity view displays: administer {entity_type} display, for example administer node display
  • entity view overrides: update access on the host entity
  • page layouts: administer page_layout
  • view displays: administer views
  • pattern presets: administer pattern preset

administer display builder profile grants the use of every profile.

Those permissions are checked at 2 different levels:

  • when accessing the Display Builder, by the controllers which are loading ProfileViewBuilder, through ProfileAccessControlHandler
  • when using the Display Builder, by the API controllers, through InstanceAccessControlHandler

In display_builder.routing.yml, the API routes which change an instance require _entity_access: display_builder_instance.update. The read-only routes (get a node, SSE stream, island reload, Preview iframe) require display_builder_instance.view. The component, block and preset library preview routes only require _role: authenticated.

Administer Display Builder

Display Builder UI sub-module add a few permissions:

  • Administer Display Builder profiles for pages in /admin/structure/display-builder
  • Administer Display Builder presets for page in /admin/structure/display-builder/preset
  • List Display Builder instances for /admin/structure/display-builder/instances page