Problem/Motivation

Discovered while working on #2819335: Resource (entity) normalization should use partial caching.

\Drupal\user\UserAccessControlHandler::checkFieldAccess() does this:

      case 'preferred_langcode':
      case 'preferred_admin_langcode':
      case 'timezone':
      case 'mail':
        // Allow view access to own mail address and other personalization
        // settings.
        if ($operation == 'view') {
          return $is_own_account ? AccessResult::allowed()->cachePerUser() : AccessResult::neutral();
        }

Note that the "else" case returns AccessResult::neutral() without any cache context. Despite that result being dependent on whether the User entity matching the current user ($is_own_account).

Proposed resolution

Fix it: add the user cache context to the "else" case too.

Remaining tasks

Tests.

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

None.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Wim Leers created an issue. See original summary.

Wim Leers’s picture

Status: Active » Needs review
FileSize
969 bytes
Wim Leers’s picture

FileSize
942 bytes
926 bytes

Or, slightly nicer.

Wim Leers’s picture

Note that this is not a security risk. The worst that can happen is that the denial of access is cached and applied to users that should have access — it is impossible that HEAD causes users who should not have access to gain access.

Wim Leers’s picture

This is a soft blocker to #2819335-41: Resource (entity) normalization should use partial caching — we can choose to disable the failing test for now, but ideally we of course would not do that.

Status: Needs review » Needs work

The last submitted patch, 3: 3026264-3.patch, failed testing. View results

Wim Leers’s picture

Title: UserAccessControlHandler::checkFieldAccess() denies access to mail field without » UserAccessControlHandler::checkFieldAccess() denies access to mail field without varting by the ‘user’ cache context
Wim Leers’s picture

Status: Needs work » Needs review
FileSize
7.84 KB
8.7 KB

This is the first case of a REST entity normalization resulting in a normalization that varies by user. So the REST base test class needed updating.

Wim Leers’s picture

Title: UserAccessControlHandler::checkFieldAccess() denies access to mail field without varting by the ‘user’ cache context » UserAccessControlHandler::checkFieldAccess() denies access to mail field without varying by the ‘user’ cache context
cspitzlay’s picture

I had this issue when requesting attributes of different users (access_tokens via simple_oauth, then requests via jsonapi).
Once a user1 tried to access a field of user2 the user2 was no longer returned their own fields they should have access to.

I tested the patch from #8 and it solves the problem for me.

Wim Leers’s picture

Status: Needs review » Reviewed & tested by the community

Marking RTBC per #10.

knyshuk.vova’s picture

+1 to RTBC

catch’s picture

Status: Reviewed & tested by the community » Fixed

Committed dde2ff8 and pushed to 8.7.x. Thanks!

  • catch committed df8b8a9 on 8.7.x
    Issue #3026264 by Wim Leers, cspitzlay: UserAccessControlHandler::...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.