Problem/Motivation

Any operation other than delete/update/view is not checked for in the access control handler. If a user has edit permissions then they also have permission to do any other operation due to the ternary.

Found when developing https://www.drupal.org/project/microcontent_revision_ui

CommentFileSizeAuthor
#2 3209633-2.patch3.66 KBacbramley
#2 3209633-2-test-only.patch1.02 KBacbramley

Comments

acbramley created an issue. See original summary.

acbramley’s picture

acbramley commented
Status: Active » Needs review
StatusFileSize
new 3209633-2-test-only.patch1.02 KB
new 3209633-2.patch3.66 KB

  • larowlan committed 35d51bd on 8.x-1.x authored by acbramley 
    Issue #3209633 by acbramley: Unknown operations are allowed if user has...
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Status: Needs review » Fixed

This will go out as beta6, thanks

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.