diff --git a/core/modules/node/src/NodeAccessControlHandler.php b/core/modules/node/src/NodeAccessControlHandler.php index 8cde33b..5deb5c9 100644 --- a/core/modules/node/src/NodeAccessControlHandler.php +++ b/core/modules/node/src/NodeAccessControlHandler.php @@ -129,14 +129,28 @@ protected function checkCreateAccess(AccountInterface $account, array $context, * {@inheritdoc} */ protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) { - $administrative_fields = array('uid', 'status', 'created', 'promote', 'sticky', 'revision_log'); - $read_only_fields = array('changed', 'revision_timestamp', 'revision_uid'); + // Only users with the administer nodes permission can edit administrative + // fields. + $administrative_fields = array('uid', 'status', 'created', 'promote', 'sticky'); if ($operation == 'edit' && in_array($field_definition->getName(), $administrative_fields)) { return $account->hasPermission('administer nodes'); } + + // No user can change read only fields. + $read_only_fields = array('changed', 'revision_timestamp', 'revision_uid'); if ($operation == 'edit' && in_array($field_definition->getName(), $read_only_fields)) { return FALSE; } + + // Users have access to the revision_log field either if they have + // administrative permissions or if the new revision option is enabled. + if ($operation == 'edit' && $field_definition->getName() == 'revision_log') { + if ($account->hasPermission('administer nodes')) { + return TRUE; + } + $node_type_settings = $items->getEntity()->type->entity->getModuleSettings('node'); + return !empty($node_type_settings['options']['revision']); + } return parent::checkFieldAccess($operation, $field_definition, $account, $items); } diff --git a/core/modules/node/src/NodeForm.php b/core/modules/node/src/NodeForm.php index 32b3296..3630488 100644 --- a/core/modules/node/src/NodeForm.php +++ b/core/modules/node/src/NodeForm.php @@ -175,7 +175,6 @@ public function form(array $form, FormStateInterface $form_state) { ), ), '#group' => 'revision_information', - '#access' => $node->isNewRevision() || $form['revision_log']['#access'], ); // Node author information for administrators. diff --git a/core/modules/node/src/Tests/NodeFieldAccessTest.php b/core/modules/node/src/Tests/NodeFieldAccessTest.php index a616243..44aaeda 100644 --- a/core/modules/node/src/Tests/NodeFieldAccessTest.php +++ b/core/modules/node/src/Tests/NodeFieldAccessTest.php @@ -8,6 +8,7 @@ use Drupal\Component\Utility\String; use Drupal\node\Entity\Node; +use Drupal\node\Entity\NodeType; use Drupal\system\Tests\Entity\EntityUnitTestBase; /** @@ -35,7 +36,6 @@ class NodeFieldAccessTest extends EntityUnitTestBase { 'sticky', 'created', 'uid', - 'revision_log', ); /** @@ -50,6 +50,32 @@ class NodeFieldAccessTest extends EntityUnitTestBase { */ function testAccessToAdministrativeFields() { + // Create the page node type with revisions disabled. + $page = NodeType::create([ + 'type' => 'page', + 'settings' => array( + 'node' => array( + 'options' => array( + 'revision' => FALSE, + ), + ), + ), + ]); + $page->save(); + + // Create the article node type with revisions disabled. + $article = NodeType::create([ + 'type' => 'article', + 'settings' => array( + 'node' => array( + 'options' => array( + 'revision' => TRUE, + ), + ), + ), + ]); + $article->save(); + // An administrator user. No user exists yet, ensure that the first user // does not have UID 1. $content_admin_user = $this->createUser(array('uid' => 2), array('administer nodes')); @@ -79,7 +105,7 @@ function testAccessToAdministrativeFields() { $node2 = Node::create(array( 'title' => $this->randomMachineName(8), 'uid' => $page_manager_user->id(), - 'type' => 'page', + 'type' => 'article', )); $node3 = Node::create(array( 'title' => $this->randomMachineName(8), @@ -122,6 +148,18 @@ function testAccessToAdministrativeFields() { $this->assertFalse($may_view, String::format('No user is not allowed to edit the field @name.', array('@name' => $field))); } } + + // Check the revision_log field on node 1 which has revisions disabled. + $may_update = $node1->revision_log->access('edit', $content_admin_user); + $this->assertTrue($may_update, 'A user with permission "administer nodes" can edit the revision_log field when revisions are disabled.'); + $may_update = $node1->revision_log->access('edit', $page_creator_user); + $this->assertFalse($may_update, 'A user without permission "administer nodes" can not edit the revision_log field when revisions are disabled.'); + + // Check the revision_log field on node 2 which has revisions enabled. + $may_update = $node2->revision_log->access('edit', $content_admin_user); + $this->assertTrue($may_update, 'A user with permission "administer nodes" can edit the revision_log field when revisions are enabled.'); + $may_update = $node2->revision_log->access('edit', $page_creator_user); + $this->assertTrue($may_update, 'A user without permission "administer nodes" can edit the revision_log field when revisions are enabled.'); } }