If there is more than one access check on a route and one access check returns TRUE to grant access but the last one returns NULL for no opinion then access is denied, which is wrong.

Patch + test case coming up in a minute.

CommentFileSizeAuthor
#3 routing-access-1896556-3.patch5.55 KBklausi
#3 routing-access-1896556-3-interdiff.txt691 bytesklausi
#1 routing-access-1-testonly.patch3.43 KBklausi
#1 routing-access-1896556-1.patch4.87 KBklausi

Comments

klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Active » Needs review
StatusFileSize
new routing-access-1896556-1.patch4.87 KB
new routing-access-1-testonly.patch3.43 KB

Patches attached.

Status: Needs review » Needs work

The last submitted patch, routing-access-1896556-1.patch, failed testing.

klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Needs work » Needs review
StatusFileSize
new routing-access-1896556-3-interdiff.txt691 bytes
new routing-access-1896556-3.patch5.55 KB

Aha, removed the stale _access setting on the REST routes.

Crell’s picture

Crell commented
Status: Needs review » Reviewed & tested by the community

Thanks, klausi.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Status: Reviewed & tested by the community » Fixed

Committed and pushed to 8.x. Thanks!

Automatically closed -- issue fixed for 2 weeks with no activity.