diff --git a/core/modules/comment/src/CommentAccessControlHandler.php b/core/modules/comment/src/CommentAccessControlHandler.php index 2dec0d9..531a812 100644 --- a/core/modules/comment/src/CommentAccessControlHandler.php +++ b/core/modules/comment/src/CommentAccessControlHandler.php @@ -58,55 +58,61 @@ protected function checkCreateAccess(AccountInterface $account, array $context, * {@inheritdoc} */ protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) { - // Only users with the "administer comments" permission can edit - // administrative fields. - $administrative_fields = array( - 'uid', - 'status', - 'created', - 'date', - ); - if ($operation == 'edit' && in_array($field_definition->getName(), $administrative_fields, TRUE)) { - return AccessResult::allowedIfHasPermission($account, 'administer comments'); - } - - // No user can change read-only fields. - $read_only_fields = array( - 'changed', - 'hostname', - 'uuid', - 'cid', - 'thread', - 'comment_type', - 'pid', - 'entity_id', - 'entity_type', - 'field_name', - ); - if ($operation == 'edit' && in_array($field_definition->getName(), $read_only_fields, TRUE)) { - return AccessResult::forbidden(); - } - /** @var \Drupal\comment\CommentInterface $entity */ $entity = $items->getEntity(); - $commented_entity = $entity->getCommentedEntity(); - $anonymous_contact = $commented_entity->get($entity->getFieldName())->getFieldDefinition()->getSetting('anonymous_contact'); + if ($operation == 'edit') { + // Only users with the "administer comments" permission can edit + // administrative fields. + $administrative_fields = array( + 'uid', + 'status', + 'created', + 'date', + ); + if (in_array($field_definition->getName(), $administrative_fields, TRUE)) { + return AccessResult::allowedIfHasPermission($account, 'administer comments'); + } + + // No user can change read-only fields. + $read_only_fields = array( + 'changed', + 'hostname', + 'uuid', + 'cid', + 'thread', + 'comment_type', + 'pid', + 'entity_id', + 'entity_type', + 'field_name', + ); + if (in_array($field_definition->getName(), $read_only_fields, TRUE)) { + return AccessResult::forbidden(); + } + $commented_entity = $entity->getCommentedEntity(); + $anonymous_contact = $commented_entity->get($entity->getFieldName())->getFieldDefinition()->getSetting('anonymous_contact'); - // Only admins or anonymous users can edit name and mail. - if ($operation == 'edit' && in_array($field_definition->getName(), ['name', 'mail', 'homepage'], TRUE)) { - // Anonymous users can only access these fields if the field is configured - // to accept anonymous contact details. - return AccessResult::allowedIf($account->hasPermission('administer comments'))->cachePerRole() - ->orIf(AccessResult::allowedIf($entity->isNew() && $account->isAnonymous() && $anonymous_contact != COMMENT_ANONYMOUS_MAYNOT_CONTACT && $account->hasPermission('post comments')) - ->cachePerRole() - ->cacheUntilEntityChanges($entity) - ->cacheUntilEntityChanges($field_definition->getConfig($commented_entity->bundle())) - ->cacheUntilEntityChanges($commented_entity)); + // Only admins or anonymous users can edit name, homepage and mail. + if (in_array($field_definition->getName(), ['name', 'mail', 'homepage'], TRUE)) { + // Anonymous users can only access these fields if the field is + // configured to accept anonymous contact details. + $admin_access = AccessResult::allowedIfHasPermission($account, 'administer comments'); + $anonymous_access = AccessResult::allowedIf($entity->isNew() && $account->isAnonymous() && $anonymous_contact != COMMENT_ANONYMOUS_MAYNOT_CONTACT && $account->hasPermission('post comments')) + ->cachePerRole() + ->cacheUntilEntityChanges($entity) + ->cacheUntilEntityChanges($field_definition->getConfig($commented_entity->bundle())) + ->cacheUntilEntityChanges($commented_entity); + return $admin_access->orIf($anonymous_access); + } } - if ($operation == 'view' && !$account->hasPermission('administer comments') && (!$account->hasPermission('access comments') || !$entity->isPublished())) { - return AccessResult::forbiddenIf(!$account->hasPermission('administer comments'))->cachePerRole() - ->orIf(AccessResult::forbiddenIf(!$account->hasPermission('access comments') || !$entity->isPublished()) - ->cacheUntilEntityChanges($entity)); + + if ($operation == 'view') { + // Admins can view any fields, other users need both the "access comments" + // permission and for the comment to be published. + $admin_access = AccessResult::allowedIfHasPermission($account, 'administer comments'); + $anonymous_access = AccessResult::allowedIf($account->hasPermission('access comments') && $entity->isPublished()) + ->cacheUntilEntityChanges($entity); + return $admin_access->orIf($anonymous_access); } return parent::checkFieldAccess($operation, $field_definition, $account, $items); }