ISTWCMS-5085: Prevent non-admin access to menu add, edit, and delete pages

src/Access/UwNodeAccessCheck.php

@@ -52,6 +52,13 @@ class UwNodeAccessCheck implements AccessInterface {
       case 'dashboards.dashboards_settings_form':
         return $account->hasPermission('access dashboard config') ? AccessResult::allowed() : AccessResult::forbidden();
 
+      // Menu link add, edit, and delete pages.
+      case 'entity.menu.add_link_form':
+      case 'entity.menu_link_content.canonical':
+      case 'entity.menu_link_content.edit_form':
+      case 'entity.menu_link_content.delete_form':
+        return $account->hasPermission('administer menu') ? AccessResult::allowed() : AccessResult::forbidden();
+
     }
 
     // Get the node object, which is in the route match variable.

src/Routing/UwNodeAccessRouteSubscriber.php

@@ -24,6 +24,16 @@ class UwNodeAccessRouteSubscriber extends RouteSubscriberBase {
       'entity.node.delete_form',
       // Menu link edit pages.
       'menu_ui.link_edit',
+      // Menu link add page.
+      // Path admin/structure/menu/manage/{menu}/add.
+      'entity.menu.add_link_form',
+      // Menu link edit page.
+      // Path admin/structure/menu/item/{menu_link_content}/edit.
+      'entity.menu_link_content.canonical',
+      'entity.menu_link_content.edit_form',
+      // Menu link delete page.
+      // Path admin/structure/menu/item/{menu_link_content}/delete.
+      'entity.menu_link_content.delete_form',
     ];
     foreach ($access_route_names as $route_name) {
       if ($route = $collection->get($route_name)) {