Problem/Motivation

Any operation other than delete/update/view is not checked for in the access control handler. If a user has edit permissions then they also have permission to do any other operation due to the ternary.

Found when developing https://www.drupal.org/project/microcontent_revision_ui

Comments

acbramley created an issue. See original summary.

acbramley’s picture

Status: Active » Needs review
StatusFileSize
new1.02 KB
new3.66 KB

  • larowlan committed 35d51bd on 8.x-1.x authored by acbramley
    Issue #3209633 by acbramley: Unknown operations are allowed if user has...
larowlan’s picture

Status: Needs review » Fixed

This will go out as beta6, thanks

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.