IBX-10854: Added ability to hide content item drafts by vidarl · Pull Request #667 · ibexa/core

vidarl · 2025-10-24T12:22:05Z

🎫 Issue	IBX-10854

It is not possible to publish content in hidden state

For QA:

Note

Edited by @alongosz

Requires security testing, e.g., if user who doesn't have hide/reveal permissions is now able to do it.

Documentation:

Steveb-p · 2025-10-24T12:23:52Z

src/lib/Repository/ContentService.php

+        // If content is in draft state, mainLocationId is yet not set
+        if ($contentInfo->mainLocationId !== null) {


If this is true, then a dedicated ContentInfo method should probably be introduced.

@Steveb-p
Okay, so I first thought about adding function like this:

+ public function isInitialDraft(): bool + { + return $this->status === self::STATUS_DRAFT && $this->currentVersionNo === 1; + }

However, then I realized that this is not needed for ContentInfo as existing ContentInfo::isDraft() will do just fine. This method will only return true if Content in question has never been published. Once Content is published, ContentInfo::isDraft() will still return false when you create new drafts for that content.

Fixed in acbb2d8

alongosz

AFAIR this is by-design. There's no purpose to hiding content drafts because content drafts can be read by people with versionread policy, the same as hidden content can be accessed. Are you trying to fix some fatal error or enable hiding drafts? TL;DR;.

vidarl · 2025-10-27T10:10:22Z

There's no purpose to hiding content drafts because

yes, it is. If you don't want content to be visible at time of publishing.

Are you trying to fix some fatal error or enable hiding drafts?

@alongosz
I am trying to publish content as hidden. The use-case is:
Write a new article but translate it to multiple languages before making it visible. Since admin-ui cannot edit multiple languages for the same version, publish it as hidden would do the trick

edited....

sonarqubecloud · 2025-10-27T11:57:36Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vidarl · 2025-11-18T13:07:34Z

ping @alongosz @Steveb-p : I have answered on your comments. Please have a look again

Steveb-p · 2025-11-18T13:54:33Z

src/lib/Repository/ContentService.php

Doesn't this mean, with this change, that for drafts every user has ability to hide & reveal?

Because we won't be checking permission resolver for drafts.

You are right. Fixed in ca2b306.
Unsure if it 100% safe to have $targets=[] in parameter to canUser() though, but seems to work fine for me when I test with limitation on content/hide policy

@Steveb-p

konradoboza · 2025-12-16T11:10:39Z

@vidarl please make sure #667 (comment) is addressed, PR is rebased and the CI lits green.

vidarl · 2026-02-24T16:30:41Z

@vidarl please make sure #667 (comment) is addressed, PR is rebased and the CI lits green.

@konradoboza
Done. Only sonar complains now about duplicated code in Tests. Which should be considered as a false-positive

src/lib/Repository/ContentService.php

tests/integration/Core/Repository/ContentServiceTest.php

… draft

…content draft

…to hide content draft" This reverts commit 0de3f32.

Co-authored-by: Konrad Oboza <konrad.oboza@ibexa.co>

tests/integration/Core/Repository/ContentServiceTest.php

… draft

sonarqubecloud · 2026-03-11T11:40:00Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vidarl · 2026-03-24T10:52:31Z

@alongosz, @konradoboza, @Steveb-p : Can you have a new look on this one. I think all review comments has been addressed

Steveb-p · 2026-03-24T11:23:46Z

src/lib/Repository/ContentService.php

+        $locationTarget = !$contentInfo->isDraft()
+            ? [new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo)]
+            : [];


When you have the option, prefer a condition without a negation, if both paths are valid.

Suggested change

$locationTarget = !$contentInfo->isDraft()

? [new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo)]

: [];

$locationTarget = $contentInfo->isDraft()

? []

: [new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo)];

Alternatively, for readability

Suggested change

$locationTarget = !$contentInfo->isDraft()

? [new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo)]

: [];

$locationTarget = [];

if ($contentInfo->isDraft() === false) {

$locationTarget[] = new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo);

}

konradoboza · 2026-03-24T11:23:59Z

tests/integration/Core/Repository/ContentServiceTest.php

+     * @throws \Ibexa\Contracts\Core\Repository\Exceptions\UnauthorizedException
+     * @throws \Ibexa\Contracts\Core\Repository\Exceptions\ContentValidationException
+     */
+    private function createContentForHideRevealDraftTests(bool $revel): Content


Suggested change

private function createContentForHideRevealDraftTests(bool $revel): Content

private function createContentForHideRevealDraftTests(bool $reveal): Content

konradoboza · 2026-03-24T11:24:06Z

tests/integration/Core/Repository/ContentServiceTest.php

+
+        $draftContentInfo = $draft->getContentInfo();
+        $this->contentService->hideContent($draftContentInfo);
+        if ($revel) {


Suggested change

if ($revel) {

if ($reveal) {

alongosz · 2026-03-24T14:29:24Z

src/lib/Repository/ContentService.php

+        $locationTarget = !$contentInfo->isDraft()
+            ? [new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo)]
+            : [];
        if (!$this->permissionResolver->canUser(
            'content',
            'hide',
            $contentInfo,
-            [$locationTarget]
+            $locationTarget


What if user is working on already published item, but doesn't have content/hide permission on a given subtree?
The scenario I'm thinking is that he's creating a draft, hides it, and publishes it as hidden. That would bypass his inability to hide in a given subtree (only if he has permission to hide in another subtree).

vidarl changed the base branch from main to 4.6 October 24, 2025 12:22

Steveb-p reviewed Oct 24, 2025

View reviewed changes

github-actions bot assigned mikadamczyk, alongosz and tischsoic Oct 24, 2025

alongosz reviewed Oct 24, 2025

View reviewed changes

vidarl requested review from Steveb-p and alongosz October 29, 2025 07:32

Steveb-p reviewed Nov 18, 2025

View reviewed changes

mateuszbieniek requested a review from Steveb-p December 4, 2025 13:23

vidarl force-pushed the IBX-10854_Not_possible_to_hide_content_draft branch from acbb2d8 to ca2b306 Compare February 10, 2026 11:37

konradoboza reviewed Feb 25, 2026

View reviewed changes

vidarl and others added 12 commits March 6, 2026 13:38

IBX-10854: Not possible to hide content draft

078e994

Added tests for IBX-10854: Not possible to hide content draft

f84a2c3

fixup! IBX-10854: Not possible to hide content draft

0d587b6

fixup! IBX-10854: Not possible to hide content draft

300106f

fixup! fixup! IBX-10854: Not possible to hide content draft

ea7c33d

fixup! Added tests for IBX-10854: Not possible to hide content draft

441abd5

Fixed PHPstan

1f4da1a

fixup! fixup! Added tests for IBX-10854: Not possible to hide content…

e236c0a

… draft

fixup! fixup! fixup! Added tests for IBX-10854: Not possible to hide …

8ca12da

…content draft

Revert "fixup! fixup! fixup! Added tests for IBX-10854: Not possible …

24ed50e

…to hide content draft" This reverts commit 0de3f32.

Apply suggestions from code review for Tests

6038c7f

Co-authored-by: Konrad Oboza <konrad.oboza@ibexa.co>

Apply suggestions from code review

6671254

Co-authored-by: Konrad Oboza <konrad.oboza@ibexa.co>

vidarl force-pushed the IBX-10854_Not_possible_to_hide_content_draft branch from e6a3f58 to 6671254 Compare March 6, 2026 12:42

fixup! Apply suggestions from code review for Tests

9f9d2da

vidarl requested a review from konradoboza March 9, 2026 14:59

konradoboza reviewed Mar 9, 2026

View reviewed changes

vidarl force-pushed the IBX-10854_Not_possible_to_hide_content_draft branch from b5d7eaa to 91fd72c Compare March 11, 2026 10:35

fixup! Added tests for IBX-10854: Not possible to hide content draft

af81e00

vidarl force-pushed the IBX-10854_Not_possible_to_hide_content_draft branch from 91fd72c to af81e00 Compare March 11, 2026 10:40

vidarl added 3 commits March 11, 2026 12:10

fixup! fixup! Added tests for IBX-10854: Not possible to hide content…

9388c37

… draft

fixup! fixup! Added tests for IBX-10854: Not possible to hide content…

4ce1f70

… draft

fixup! IBX-10854: Not possible to hide content draft

14870af

vidarl requested a review from konradoboza March 11, 2026 11:33

Steveb-p reviewed Mar 24, 2026

View reviewed changes

konradoboza approved these changes Mar 24, 2026

View reviewed changes

Steveb-p approved these changes Mar 24, 2026

View reviewed changes

alongosz changed the title ~~IBX-10854 not possible to hide content draft~~ IBX-10854: Added ability to hide content item drafts Mar 24, 2026

alongosz reviewed Mar 24, 2026

View reviewed changes

		// If content is in draft state, mainLocationId is yet not set
		if ($contentInfo->mainLocationId !== null) {

-        $locationTarget = !$contentInfo->isDraft()
-            ? [new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo)]
-            : [];
+        $locationTarget = [];
+        if ($contentInfo->isDraft() === false) {
+            $locationTarget[] = new DestinationLocationTarget($contentInfo->getMainLocationId(), $contentInfo);
+        }

	private function createContentForHideRevealDraftTests(bool $revel): Content
	private function createContentForHideRevealDraftTests(bool $reveal): Content

Conversation

vidarl commented Oct 24, 2025 • edited by alongosz Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

For QA:

Documentation:

Uh oh!

Steveb-p Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

vidarl Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alongosz left a comment

Choose a reason for hiding this comment

Uh oh!

vidarl commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Oct 27, 2025

Quality Gate passed

Uh oh!

vidarl commented Nov 18, 2025

Uh oh!

Steveb-p Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

vidarl Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

konradoboza commented Dec 16, 2025

Uh oh!

vidarl commented Feb 24, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Mar 11, 2026

Quality Gate passed

Uh oh!

vidarl commented Mar 24, 2026

Uh oh!

Steveb-p Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

konradoboza Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

konradoboza Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

alongosz Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vidarl commented Oct 24, 2025 •

edited by alongosz

Loading

vidarl Oct 27, 2025 •

edited

Loading

vidarl commented Oct 27, 2025 •

edited

Loading