diff --git a/core/lib/Drupal/Core/Entity/EntityAccessController.php b/core/lib/Drupal/Core/Entity/EntityAccessController.php index b092914..ddd5587 100644 --- a/core/lib/Drupal/Core/Entity/EntityAccessController.php +++ b/core/lib/Drupal/Core/Entity/EntityAccessController.php @@ -286,6 +286,12 @@ public function fieldAccess($operation, FieldDefinitionInterface $field_definiti // Get the default access restriction that lives within this field. $default = $items ? $items->defaultAccess($operation, $account) : TRUE; + // Get the default access restriction as specified by the access controller. + $entity_default = $this->checkFieldAccess($operation, $field_definition, $account, $items); + + // Combine default access, denying access wins. + $default = $default && $entity_default; + // Invoke hook and collect grants/denies for field access from other // modules. Our default access flag is masked under the ':default' key. $grants = array(':default' => $default); @@ -315,4 +321,26 @@ public function fieldAccess($operation, FieldDefinitionInterface $field_definiti return FALSE; } + /** + * Default field access as determined by this access controller. + * + * @param string $operation + * The operation access should be checked for. + * Usually one of "view" or "edit". + * @param \Drupal\Core\Field\FieldDefinitionInterface $field_definition + * The field definition. + * @param \Drupal\Core\Session\AccountInterface $account + * The user session for which to check access. + * @param \Drupal\Core\Field\FieldItemListInterface $items + * (optional) The field values for which to check access, or NULL if access + * is checked for the field definition, without any specific value + * available. Defaults to NULL. + * + * @return bool + * TRUE if access is allowed, FALSE otherwise. + */ + protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) { + return TRUE; + } + } diff --git a/core/modules/user/src/UserAccessController.php b/core/modules/user/src/UserAccessController.php index 9aed19e..b85c8f7 100644 --- a/core/modules/user/src/UserAccessController.php +++ b/core/modules/user/src/UserAccessController.php @@ -9,6 +9,8 @@ use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityAccessController; +use Drupal\Core\Field\FieldDefinitionInterface; +use Drupal\Core\Field\FieldItemListInterface; use Drupal\Core\Session\AccountInterface; /** @@ -60,4 +62,58 @@ protected function viewAccess(EntityInterface $entity, $langcode, AccountInterfa return FALSE; } + /** + * {@inheritdoc} + */ + protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) { + // Administrative users are allowed to edit and view all fields. + if ($account->hasPermission('administer users')) { + return TRUE; + } + // Flag to indicate if this user entity is the own user account. + $is_own_account = $items ? $items->getEntity()->id() == $account->id() : FALSE; + switch ($field_definition->getName()) { + case 'name': + // Allow view access to anyone with access to the entity. + if ($operation == 'view') { + return TRUE; + } + // Allow edit access for the own user name if the permission is + // satisfied. + return $is_own_account && $account->hasPermission('change own username'); + + case 'preferred_langcode': + case 'preferred_admin_langcode': + case 'signature': + case 'signature_format': + case 'timezone': + case 'mail': + // Allow view access to own mail address and other personalization + // settings. + if ($operation == 'view') { + return $is_own_account; + } + // Anyone that can edit the user can also edit this field. + return TRUE; + + case 'pass': + // Allow editing the password, but not viewing it. + return $operation == 'edit'; + + case 'created': + // Allow viewing the created date, but not editing it. + return $operation == 'view'; + + case 'roles': + case 'status': + case 'access': + case 'login': + case 'init': + return FALSE; + + } + // Allow access to all other fields. + return TRUE; + } + } diff --git a/core/modules/user/tests/src/Entity/UserAccessControllerTest.php b/core/modules/user/tests/src/Entity/UserAccessControllerTest.php new file mode 100644 index 0000000..389ee35 --- /dev/null +++ b/core/modules/user/tests/src/Entity/UserAccessControllerTest.php @@ -0,0 +1,368 @@ + 'User access controller', + 'description' => 'Tests the user access controller.', + 'group' => 'User', + ); + } + + /** + * {@inheritdoc} + */ + public function setUp() { + parent::setUp(); + $this->viewer = $this->getMock('\Drupal\Core\Session\AccountInterface'); + $this->viewer + ->expects($this->any()) + ->method('hasPermission') + ->will($this->returnValue(FALSE)); + $this->viewer + ->expects($this->any()) + ->method('id') + ->will($this->returnValue(1)); + + $this->owner = $this->getMock('\Drupal\Core\Session\AccountInterface'); + $this->owner + ->expects($this->any()) + ->method('hasPermission') + ->will($this->returnValueMap(array( + array('administer users', FALSE), + array('change own username', TRUE), + ))); + + $this->owner + ->expects($this->any()) + ->method('id') + ->will($this->returnValue(2)); + + $this->admin = $this->getMock('\Drupal\Core\Session\AccountInterface'); + $this->admin + ->expects($this->any()) + ->method('hasPermission') + ->will($this->returnValue(TRUE)); + + $entity_type = $this->getMock('Drupal\Core\Entity\EntityTypeInterface'); + + $this->accessController = new UserAccessController($entity_type); + $module_handler = $this->getMock('Drupal\Core\Extension\ModuleHandlerInterface'); + $module_handler->expects($this->any()) + ->method('getImplementations') + ->will($this->returnValue(array())); + $this->accessController->setModuleHandler($module_handler); + + $this->items = $this->getMockBuilder('Drupal\Core\Field\FieldItemList') + ->disableOriginalConstructor() + ->getMock(); + $this->items + ->expects($this->any()) + ->method('defaultAccess') + ->will($this->returnValue(TRUE)); + } + + /** + * Asserts correct field access grants for a field. + */ + public function assertFieldAccess($field, $viewer, $target, $view, $edit) { + $field_definition = $this->getMock('Drupal\Core\Field\FieldDefinitionInterface'); + $field_definition->expects($this->any()) + ->method('getName') + ->will($this->returnValue($field)); + + $this->items + ->expects($this->any()) + ->method('getEntity') + ->will($this->returnValue($this->{$target})); + + foreach (array('view' => $view, 'edit' => $edit) as $operation => $result) { + $message = String::format("User @field field access returns @result with operation '@op' for @account accessing @target", array( + '@field' => $field, + '@result' => !isset($result) ? 'null' : ($result ? 'true' : 'false'), + '@op' => $operation, + '@account' => $viewer, + '@target' => $target, + )); + $this->assertSame($result, $this->accessController->fieldAccess($operation, $field_definition, $this->{$viewer}, $this->items), $message); + } + } + + /** + * Ensures user name access is working properly. + * + * @dataProvider userNameProvider + */ + public function testUserNameAccess($viewer, $target, $view, $edit) { + $this->assertFieldAccess('name', $viewer, $target, $view, $edit); + } + + /** + * Provides test data for estUserNameAccess(). + */ + public function userNameProvider() { + $name_access = array( + // The viewer user is allowed to see user names on all accounts. + array( + 'viewer' => 'viewer', + 'target' => 'viewer', + 'view' => TRUE, + 'edit' => FALSE, + ), + array( + 'viewer' => 'owner', + 'target' => 'viewer', + 'view' => TRUE, + 'edit' => FALSE, + ), + array( + 'viewer' => 'viewer', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => FALSE, + ), + // The owner user is allowed to change its own user name. + array( + 'viewer' => 'owner', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => TRUE, + ), + // The users-administrator user has full access. + array( + 'viewer' => 'admin', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => TRUE, + ), + ); + return $name_access; + } + + /** + * Tests that private user settings cannot be viewed by other users. + * + * @dataProvider hiddenUserSettingsProvider + */ + public function testHiddenUserSettings($field, $viewer, $target, $view, $edit) { + $this->assertFieldAccess($field, $viewer, $target, $view, $edit); + } + + /** + * Provides test data for testHiddenUserSettings(). + */ + public function hiddenUserSettingsProvider() { + foreach (array( + 'preferred_langcode', + 'preferred_admin_langcode', + 'signature', + 'signature_format', + 'timezone', + 'mail') as $field + ) { + $access_info = array( + array( + 'field' => $field, + 'viewer' => 'viewer', + 'target' => 'viewer', + 'view' => TRUE, + 'edit' => TRUE, + ), + array( + 'field' => $field, + 'viewer' => 'viewer', + 'target' => 'owner', + 'view' => FALSE, + // Anyone with edit access to the user can also edit these fields. + 'edit' => TRUE, + ), + array( + 'field' => $field, + 'viewer' => 'admin', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => TRUE, + ) + ); + return $access_info; + } + } + + /** + * Tests that private user settings cannot be viewed by other users. + * + * @dataProvider adminFieldAccessProvider + */ + public function testAdminFieldAccess($field, $viewer, $target, $view, $edit) { + $this->assertFieldAccess($field, $viewer, $target, $view, $edit); + } + + /** + * Provides test data for testAdminFieldAccess(). + */ + public function adminFieldAccessProvider() { + foreach (array( + 'roles', + 'status', + 'access', + 'login', + 'init') as $field + ) { + $access_info = array( + array( + 'field' => $field, + 'viewer' => 'viewer', + 'target' => 'viewer', + 'view' => FALSE, + 'edit' => FALSE, + ), + array( + 'field' => $field, + 'viewer' => 'viewer', + 'target' => 'owner', + 'view' => FALSE, + 'edit' => FALSE, + ), + array( + 'field' => $field, + 'viewer' => 'admin', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => TRUE, + ) + ); + return $access_info; + } + } + + /** + * Tests that paswords cannot be viewed, just edited. + * + * @dataProvider passwordAccessProvider + */ + public function testPasswordAccess($viewer, $target, $view, $edit) { + $this->assertFieldAccess('pass', $viewer, $target, $view, $edit); + } + + /** + * Provides test data for passwordAccessProvider(). + */ + public function passwordAccessProvider() { + $pass_access = array( + array( + 'viewer' => 'viewer', + 'target' => 'viewer', + 'view' => FALSE, + 'edit' => TRUE, + ), + array( + 'viewer' => 'owner', + 'target' => 'viewer', + 'view' => FALSE, + 'edit' => TRUE, + ), + array( + 'viewer' => 'admin', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => TRUE, + ), + ); + return $pass_access; + } + + /** + * Tests the user created field access. + * + * @dataProvider createdAccessProvider + */ + public function testCreatedAccess($viewer, $target, $view, $edit) { + $this->assertFieldAccess('created', $viewer, $target, $view, $edit); + } + + /** + * Provides test data for testCreatedAccess(). + */ + public function createdAccessProvider() { + $created_access = array( + array( + 'viewer' => 'viewer', + 'target' => 'viewer', + 'view' => TRUE, + 'edit' => FALSE, + ), + array( + 'viewer' => 'owner', + 'target' => 'viewer', + 'view' => TRUE, + 'edit' => FALSE, + ), + array( + 'viewer' => 'admin', + 'target' => 'owner', + 'view' => TRUE, + 'edit' => TRUE, + ), + ); + return $created_access; + } + +}