diff --git a/core/modules/comment/src/CommentAccessControlHandler.php b/core/modules/comment/src/CommentAccessControlHandler.php index 028e028..6f529ca 100644 --- a/core/modules/comment/src/CommentAccessControlHandler.php +++ b/core/modules/comment/src/CommentAccessControlHandler.php @@ -136,7 +136,7 @@ protected function checkFieldAccess($operation, FieldDefinitionInterface $field_ return AccessResult::forbidden(); } if ($field_definition->getName() == 'mail') { - return AccessResult::allowedIf($account->hasPermission('administer comments')); + return AccessResult::allowedIfHasPermission($account, 'administer comments'); } } return parent::checkFieldAccess($operation, $field_definition, $account, $items); diff --git a/core/modules/comment/src/Tests/CommentFieldAccessTest.php b/core/modules/comment/src/Tests/CommentFieldAccessTest.php index 1f84bb5..b1c3103 100644 --- a/core/modules/comment/src/Tests/CommentFieldAccessTest.php +++ b/core/modules/comment/src/Tests/CommentFieldAccessTest.php @@ -174,36 +174,10 @@ public function testAccessToAdministrativeFields() { 'uid' => $comment_enabled_user->id(), ]); $comment2->save(); - $comment3 = Comment::create([ - 'entity_type' => 'entity_test', - 'hostname' => 'magic.example.com', - // Unpublished. - 'status' => 0, - 'subject' => 'Gail the minky whale', - 'entity_id' => $host->id(), - 'comment_type' => 'comment', - 'field_name' => 'comment_other', - 'pid' => $comment2->id(), - 'uid' => $comment_no_edit_user->id(), - ]); - $comment3->save(); - // Note we intentionally don't save this comment so it remains 'new'. - $comment4 = Comment::create([ - 'entity_type' => 'entity_test', - 'hostname' => 'magic.example.com', - // Unpublished. - 'status' => 0, - 'subject' => 'Daniel the Cocker-Spaniel', - 'entity_id' => $host->id(), - 'comment_type' => 'comment', - 'field_name' => 'comment_other', - 'pid' => 0, - 'uid' => $anonymous_user->id(), - ]); // Generate permutations. $combinations = [ - 'comment' => [$comment1, $comment2, $comment3, $comment4], + 'comment' => [$comment1, $comment2], 'user' => [$comment_admin_user, $comment_enabled_user, $comment_no_edit_user, $comment_disabled_user, $anonymous_user] ]; $permutations = TestBase::generatePermutations($combinations); @@ -211,14 +185,7 @@ public function testAccessToAdministrativeFields() { // Check access to administrative fields. foreach ($this->administrativeFields as $field) { foreach ($permutations as $set) { - $may_view = $set['comment']->{$field}->access('view', $set['user']); $may_update = $set['comment']->{$field}->access('edit', $set['user']); - $this->assertEqual($may_view, $set['user']->hasPermission('administer comments') || ($set['comment']->isPublished() && $set['user']->hasPermission('access comments')), SafeMarkup::format('User @user @state view field @field on comment @comment', [ - '@user' => $set['user']->getUsername(), - '@state' => $may_update ? 'can' : 'cannot', - '@comment' => $set['comment']->getSubject(), - '@field' => $field, - ])); $this->assertEqual($may_update, $set['user']->hasPermission('administer comments'), SafeMarkup::format('User @user @state update field @field on comment @comment', [ '@user' => $set['user']->getUsername(), '@state' => $may_update ? 'can' : 'cannot', @@ -242,15 +209,7 @@ public function testAccessToAdministrativeFields() { foreach ($this->readOnlyFields as $field) { // Check view operation. foreach ($permutations as $set) { - $may_view = $set['comment']->{$field}->access('view', $set['user']); $may_update = $set['comment']->{$field}->access('edit', $set['user']); - $this->assertEqual($may_view, $field != 'hostname' && ($set['user']->hasPermission('administer comments') || - ($set['comment']->isPublished() && $set['user']->hasPermission('access comments'))), SafeMarkup::format('User @user @state view field @field on comment @comment', [ - '@user' => $set['user']->getUsername(), - '@state' => $may_view ? 'can' : 'cannot', - '@comment' => $set['comment']->getSubject(), - '@field' => $field, - ])); $this->assertFalse($may_update, SafeMarkup::format('User @user @state update field @field on comment @comment', [ '@user' => $set['user']->getUsername(), '@state' => $may_update ? 'can' : 'cannot', @@ -264,15 +223,7 @@ public function testAccessToAdministrativeFields() { foreach ($this->createOnlyFields as $field) { // Check view operation. foreach ($permutations as $set) { - $may_view = $set['comment']->{$field}->access('view', $set['user']); $may_update = $set['comment']->{$field}->access('edit', $set['user']); - $this->assertEqual($may_view, $field != 'hostname' && ($set['user']->hasPermission('administer comments') || - ($set['comment']->isPublished() && $set['user']->hasPermission('access comments'))), SafeMarkup::format('User @user @state view field @field on comment @comment', [ - '@user' => $set['user']->getUsername(), - '@state' => $may_view ? 'can' : 'cannot', - '@comment' => $set['comment']->getSubject(), - '@field' => $field, - ])); $this->assertEqual($may_update, $set['user']->hasPermission('post comments') && $set['comment']->isNew(), SafeMarkup::format('User @user @state update field @field on comment @comment', [ '@user' => $set['user']->getUsername(), '@state' => $may_update ? 'can' : 'cannot', @@ -307,6 +258,10 @@ public function testAccessToAdministrativeFields() { // Check no view-access to mail field for other than admin. $may_view = $set['comment']->mail->access('view', $set['user']); $this->assertEqual($may_view, $set['user']->hasPermission('administer comments')); + + // Check no view-access to hostname field for anymore. + $may_view = $set['comment']->hostname->access('view', $set['user']); + $this->assertEqual($may_view, FALSE); } }