Drupal is a registered trademark of Dries Buytaert
drupal 11.3.7 — Update released for Drupal core (11.3.7)! drupal 11.2.11 — Update released for Drupal core (11.2.11)! drupal 10.6.7 — Update released for Drupal core (10.6.7)! drupal 10.5.9 — Update released for Drupal core (10.5.9)! cms 2.1.1 — Update released for Drupal core (2.1.1)! drupal 11.3.6 — Update released for Drupal core (11.3.6)! drupal 10.6.6 — Update released for Drupal core (10.6.6)! cms 2.1.0 — Update released for Drupal core (2.1.0)! bootstrap 8.x-3.40 — Minor update available for theme bootstrap (8.x-3.40). menu_link_attributes 8.x-1.7 — Minor update available for module menu_link_attributes (8.x-1.7). eca 3.1.1 — Minor update available for module eca (3.1.1). layout_paragraphs 2.1.3 — Minor update available for module layout_paragraphs (2.1.3). ai 1.3.3 — Minor update available for module ai (1.3.3). ai 1.2.14 — Minor update available for module ai (1.2.14). node_revision_delete 2.0.3 — Minor update available for module node_revision_delete (2.0.3). moderated_content_bulk_publish 2.0.52 — Minor update available for module moderated_content_bulk_publish (2.0.52). klaro 3.0.10 — Minor update available for module klaro (3.0.10). klaro 3.0.9 — Minor update available for module klaro (3.0.9). layout_paragraphs 2.1.2 — Minor update available for module layout_paragraphs (2.1.2). geofield_map 11.1.8 — Minor update available for module geofield_map (11.1.8).
← All modules

disable_ui

51 sites Security covered
View on drupal.org

This small module is intended to be used on headless Drupal sites where only admins and developers should have access to the Drupal UI, and regular/authenticated users should not. This is accomplished via a new permission called "Access UI routes".

The permission only applies to routes that the module determines are not API routes. The determination is based on the format requirements specified on each route. Any route that declares a _format requirement that starts with the string 'api_' or ends with the string 'json' is considered an API route. This crude heuristic seems to work for both the RESTful Web Services and JSON:API modules in core. YMMV for third-party modules that handle API requests in their own controllers without any special sentinel values in their routes.

In addition, special system routes (like the CSRF token endpoint for RESTful Web Services) as well as the user login and password reset forms are excluded from access restrictions via a new hook_disable_ui_route_exclusions(). If your site needs to expose more routes to users, you should either ensure that the _format of your route is correct (if you are exposing an API) or you should implement the new hook (if you are exposing an HTML page).

Credits

Project icon made by Freepik from www.flaticon.com

Activity

Total releases
1
First release
Jul 2025
Latest release
9 months ago
Release cadence
—
Stability
100% stable

Releases

Version Type Release date
1.0.7 Stable Jul 2, 2025