diff --git a/core/modules/content_moderation/src/Access/LatestRevisionCheck.php b/core/modules/content_moderation/src/Access/LatestRevisionCheck.php index 61ccff2..db0cde4 100644 --- a/core/modules/content_moderation/src/Access/LatestRevisionCheck.php +++ b/core/modules/content_moderation/src/Access/LatestRevisionCheck.php @@ -55,10 +55,16 @@ public function access(Route $route, RouteMatchInterface $route_match, AccountIn // This tab should not show up unless there's a reason to show it. $entity = $this->loadEntity($route, $route_match); if ($this->moderationInfo->hasForwardRevision($entity)) { - return AccessResult::allowedIfHasPermissions($account, ['view latest version', 'view any unpublished content']) - ->orIf(AccessResult::allowedIfHasPermissions($account, ['view latest version', 'view own unpublished content']) - ->andif(AccessResult::allowedIf($entity instanceof EntityOwnerInterface && $entity->getOwnerId() == $account->id())) - )->addCacheableDependency($entity); + // Check the global permissions first. + $access_result = AccessResult::allowedIfHasPermissions($account, ['view latest version', 'view any unpublished content']); + if (!$access_result->isAllowed()) { + // Check entity owner access. + $owner_access = AccessResult::allowedIfHasPermissions($account, ['view latest version', 'view own unpublished content']); + $owner_access = $owner_access->andIf((AccessResult::allowedIf($entity instanceof EntityOwnerInterface && ($entity->getOwnerId() == $account->id())))); + $access_result = $access_result->orIf($owner_access); + } + + return $access_result->addCacheableDependency($entity); } return AccessResult::forbidden()->addCacheableDependency($entity); diff --git a/core/modules/content_moderation/tests/src/Unit/LatestRevisionCheckTest.php b/core/modules/content_moderation/tests/src/Unit/LatestRevisionCheckTest.php index 1965812..2d33ee8 100644 --- a/core/modules/content_moderation/tests/src/Unit/LatestRevisionCheckTest.php +++ b/core/modules/content_moderation/tests/src/Unit/LatestRevisionCheckTest.php @@ -112,16 +112,20 @@ public function accessSituationProvider() { // Node with own content permissions and latest version. [Node::class, 'node', TRUE, ['view latest version', 'view own unpublished content'], TRUE, AccessResultAllowed::class], // Node with own content permissions and no latest version. - [Node::class, 'node', TRUE, ['view latest version', 'view own unpublished content'], FALSE, AccessResultNeutral::class], + [Node::class, 'node', FALSE, ['view latest version', 'view own unpublished content'], FALSE, AccessResultForbidden::class], // Node with own content permissions and latest version, but no perms to // view latest version. [Node::class, 'node', TRUE, ['view own unpublished content'], TRUE, AccessResultNeutral::class], // Node with own content permissions and no latest version, but no perms // to view latest version. [Node::class, 'node', TRUE, ['view own unpublished content'], FALSE, AccessResultNeutral::class], + // Block with forward revision, and permissions to view any. [BlockContent::class, 'block_content', TRUE, ['view latest version', 'view any unpublished content'], FALSE, AccessResultAllowed::class], + // Block with no forward revision. [BlockContent::class, 'block_content', FALSE, ['view latest version', 'view any unpublished content'], FALSE, AccessResultForbidden::class], + // Block with forward revision, but no permission to view any. [BlockContent::class, 'block_content', TRUE, ['view latest version', 'view own unpublished content'], FALSE, AccessResultNeutral::class], + // Block with no forward revision. [BlockContent::class, 'block_content', FALSE, ['view latest version', 'view own unpublished content'], FALSE, AccessResultForbidden::class], ]; }