diff --git a/core/modules/contact/src/Access/ContactPageAccess.php b/core/modules/contact/src/Access/ContactPageAccess.php index 0e968c5..27a4867 100644 --- a/core/modules/contact/src/Access/ContactPageAccess.php +++ b/core/modules/contact/src/Access/ContactPageAccess.php @@ -65,6 +65,12 @@ public function access(UserInterface $user, AccountInterface $account) { return AccessResult::forbidden(); } + // User administrators should always have access to personal contact forms. + $permission_access = AccessResult::allowedIfHasPermission($account, 'administer users'); + if ($permission_access->isAllowed()) { + return $access->orIf($permission_access); + } + // Users may not contact themselves by default, hence this requires user // granularity for caching. $access = AccessResult::neutral()->cachePerUser(); @@ -72,12 +78,6 @@ public function access(UserInterface $user, AccountInterface $account) { return $access; } - // User administrators should always have access to personal contact forms. - $permission_access = AccessResult::allowedIfHasPermission($account, 'administer users'); - if ($permission_access->isAllowed()) { - return $access->orIf($permission_access); - } - // If requested user has been blocked, do not allow users to contact them. $access->addCacheableDependency($contact_account); if ($contact_account->isBlocked()) { diff --git a/core/modules/contact/src/Tests/ContactPersonalTest.php b/core/modules/contact/src/Tests/ContactPersonalTest.php index 8b1a7a1..0331b8e 100644 --- a/core/modules/contact/src/Tests/ContactPersonalTest.php +++ b/core/modules/contact/src/Tests/ContactPersonalTest.php @@ -116,14 +116,7 @@ function testPersonalContactAccess() { // Check the page title is properly displayed. $this->assertRaw(t('Contact @username', array('@username' => $this->adminUser->getUsername()))); - // Test denied access to admin user's own contact form. - $this->drupalLogout(); - $this->drupalLogin($this->adminUser); - $this->drupalGet('user/' . $this->adminUser->id() . '/contact'); - $this->assertResponse(403); - // Test allowed access to user with contact form enabled. - $this->drupalLogin($this->webUser); $this->drupalGet('user/' . $this->contactUser->id() . '/contact'); $this->assertResponse(200);