Admin Global Search was build in a hurry #7698
Description
The admin global search is not entirely translatable, extensible and does not take into account the ACL settings for the current user
Preconditions
Installed Version: 2.2.0-dev
Steps to reproduce
- Install any other language pack
- Create an admin role that does not have access to orders and an admin user assigned to that role
- Login as the user created in the step above
- Search for something in the admin global search.
Expected result
- I should see the links to " keywords in Products", " keywords in Customers", " keywords in Pages" only and translated in the selected language.
- I should see results for products, pages and customers matching my keywords (this actually works).
Actual result
- I see the link "keywords in Orders" that I should not see because I don't have access to orders. Clicking it takes me to an "Access denied" page.
- The texts "in products", "in pages"... are not translated
Additional information.
The actual results explained above happen because the template that displays the global search results contains the hardcoded values for the links to pages, customers, products and orders. (lines 30 to 41) and the texts "in products", "in pages" don't go through the translation function __.
Additional issues related to the global search.
The global search is partially extensible (without changing the template that renders the results).
I can add my own entity that can be searchable in the global search but I cannot add a link. For example if I have an entity called "Article", I can make the instances searchable but I cannot get a link saying "keywords in Articles" without changing the template.
Suggestion to make it extensible and to avoid ACL related issues.
The links "keywords in ..." should come from the di.xml file and have the ACL for those links checked before displaying the links. Similar to how the actual entity search works.