diff --git a/core/includes/entity.inc b/core/includes/entity.inc index e5d2ae5..32fed26 100644 --- a/core/includes/entity.inc +++ b/core/includes/entity.inc @@ -666,3 +666,18 @@ function entity_get_render_display(EntityInterface $entity, $view_mode) { function entity_query($entity_type, $conjunction = 'AND') { return drupal_container()->get('entity.query')->get($entity_type, $conjunction); } + +/** + * Generic access callback for entity pages. + * + * @param \Drupal\Core\Entity\EntityInterface $entity + * The entity for which access is being checked. + * @param string $operation + * (optional) The operation being performed on the entity. Defaults to 'view'. + * + * @return bool + * TRUE if the access is granted. FALSE if access is denied. + */ +function entity_page_access(EntityInterface $entity, $operation = 'view') { + return $entity->access($operation); +} diff --git a/core/modules/tracker/tracker.module b/core/modules/tracker/tracker.module index d33a878..4517021 100644 --- a/core/modules/tracker/tracker.module +++ b/core/modules/tracker/tracker.module @@ -185,7 +185,7 @@ function _tracker_myrecent_access($account) { * @see tracker_menu() */ function _tracker_user_access($account) { - return user_view_access($account) && user_access('access content'); + return $account->access('view') && user_access('access content'); } /** diff --git a/core/modules/user/lib/Drupal/user/Plugin/Core/Entity/User.php b/core/modules/user/lib/Drupal/user/Plugin/Core/Entity/User.php index 9b68355..c2edb34 100644 --- a/core/modules/user/lib/Drupal/user/Plugin/Core/Entity/User.php +++ b/core/modules/user/lib/Drupal/user/Plugin/Core/Entity/User.php @@ -19,6 +19,7 @@ * label = @Translation("User"), * module = "user", * controller_class = "Drupal\user\UserStorageController", + * access_controller_class = "Drupal\user\UserAccessController", * form_controller_class = { * "profile" = "Drupal\user\ProfileFormController", * "register" = "Drupal\user\RegisterFormController" diff --git a/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkCancel.php b/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkCancel.php index 51fb108..4d6cd27 100644 --- a/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkCancel.php +++ b/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkCancel.php @@ -26,7 +26,7 @@ class LinkCancel extends Link { * Overrides \Drupal\user\Plugin\views\field\Link::render_link(). */ public function render_link(EntityInterface $entity, \stdClass $values) { - if ($entity && user_cancel_access($entity)) { + if ($entity && $entity->access('delete')) { $this->options['alter']['make_link'] = TRUE; $text = !empty($this->options['text']) ? $this->options['text'] : t('cancel'); diff --git a/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkEdit.php b/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkEdit.php index 27909e4..82931c9 100644 --- a/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkEdit.php +++ b/core/modules/user/lib/Drupal/user/Plugin/views/field/LinkEdit.php @@ -26,7 +26,7 @@ class LinkEdit extends Link { * Overrides \Drupal\user\Plugin\views\field\Link::render_link(). */ public function render_link(EntityInterface $entity, \stdClass $values) { - if ($entity && user_edit_access($entity)) { + if ($entity && $entity->access('edit')) { $this->options['alter']['make_link'] = TRUE; $text = !empty($this->options['text']) ? $this->options['text'] : t('edit'); diff --git a/core/modules/user/lib/Drupal/user/UserAccessController.php b/core/modules/user/lib/Drupal/user/UserAccessController.php new file mode 100644 index 0000000..f0202d0 --- /dev/null +++ b/core/modules/user/lib/Drupal/user/UserAccessController.php @@ -0,0 +1,74 @@ +uid; + if (!$account) { + $account = $GLOBALS['user']; + } + + // Never allow access to view the anonymous user account. + if ($uid) { + // Admins can view all, users can view own profiles at all times. + if ($account->uid == $uid || user_access('administer users', $account)) { + return TRUE; + } + elseif (user_access('access user profiles', $account)) { + // Only allow view access if the account is active. + return $entity->status; + } + } + return FALSE; + } + + /** + * Implements EntityAccessControllerInterface::createAccess(). + */ + public function createAccess(EntityInterface $entity, $langcode = LANGUAGE_DEFAULT, User $account = NULL) { + return user_access('administer users', $account); + } + + /** + * Implements EntityAccessControllerInterface::updateAccess(). + */ + public function updateAccess(EntityInterface $entity, $langcode = LANGUAGE_DEFAULT, User $account = NULL) { + if (!$account) { + $account = $GLOBALS['user']; + } + // Users can always edit their own account. Users with the 'administer + // users' permission can edit any account except the anonymous account. + return (($account->uid == $entity->uid) || user_access('administer users', $account)) && $entity->uid > 0; + } + + /** + * Implements EntityAccessControllerInterface::deleteAccess(). + */ + public function deleteAccess(EntityInterface $entity, $langcode = LANGUAGE_DEFAULT, User $account = NULL) { + if (!$account) { + $account = $GLOBALS['user']; + } + // Users with 'cancel account' permission can cancel their own account, + // users with 'administer users' permission can cancel any account except + // the anonymous account. + return ((($account->uid == $entity->uid) && user_access('cancel account', $account)) || user_access('administer users', $account)) && $entity->uid > 0; + } + +} diff --git a/core/modules/user/user.module b/core/modules/user/user.module index 89bc6c1..2d41e3b 100644 --- a/core/modules/user/user.module +++ b/core/modules/user/user.module @@ -835,49 +835,6 @@ function user_register_access() { } /** - * User view access callback. - * - * @param $account - * Can either be a full user object or a $uid. - */ -function user_view_access($account) { - $uid = is_object($account) ? $account->uid : (int) $account; - - // Never allow access to view the anonymous user account. - if ($uid) { - // Admins can view all, users can view own profiles at all times. - if ($GLOBALS['user']->uid == $uid || user_access('administer users')) { - return TRUE; - } - elseif (user_access('access user profiles')) { - // At this point, load the complete account object. - if (!is_object($account)) { - $account = user_load($uid); - } - return (is_object($account) && $account->status); - } - } - return FALSE; -} - -/** - * Access callback for user account editing. - */ -function user_edit_access($account) { - return (($GLOBALS['user']->uid == $account->uid) || user_access('administer users')) && $account->uid > 0; -} - -/** - * Menu access callback; limit access to account cancellation pages. - * - * Limit access to users with the 'cancel account' permission or administrative - * users, and prevent the anonymous user from cancelling the account. - */ -function user_cancel_access($account) { - return ((($GLOBALS['user']->uid == $account->uid) && user_access('cancel account')) || user_access('administer users')) && $account->uid > 0; -} - -/** * Implements hook_menu(). */ function user_menu() { @@ -1043,7 +1000,7 @@ function user_menu() { 'title arguments' => array(1), 'page callback' => 'user_view_page', 'page arguments' => array(1), - 'access callback' => 'user_view_access', + 'access callback' => 'entity_page_access', 'access arguments' => array(1), ); @@ -1057,8 +1014,8 @@ function user_menu() { 'title' => 'Cancel account', 'page callback' => 'drupal_get_form', 'page arguments' => array('user_cancel_confirm_form', 1), - 'access callback' => 'user_cancel_access', - 'access arguments' => array(1), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'delete'), 'file' => 'user.pages.inc', ); @@ -1066,8 +1023,8 @@ function user_menu() { 'title' => 'Confirm account cancellation', 'page callback' => 'user_cancel_confirm', 'page arguments' => array(1, 4, 5), - 'access callback' => 'user_cancel_access', - 'access arguments' => array(1), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'delete'), 'file' => 'user.pages.inc', ); @@ -1075,8 +1032,8 @@ function user_menu() { 'title' => 'Edit', 'page callback' => 'entity_get_form', 'page arguments' => array(1, 'profile'), - 'access callback' => 'user_edit_access', - 'access arguments' => array(1), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'edit'), 'type' => MENU_LOCAL_TASK, 'file' => 'user.pages.inc', ); @@ -2679,7 +2636,7 @@ function user_rdf_mapping() { */ function user_file_download_access($field, EntityInterface $entity, File $file) { if ($entity->entityType() == 'user') { - return user_view_access($entity); + return $entity->access('view'); } }