Several places in the module use this pattern for access checks:

    // Only allow access if the user can create group content using the
    // provided plugin or if he doesn't need access to do so.
    return AccessResult::allowedIf($access xor !$needs_access);

Why deny access if both apply?
If the user doesn't need access to be checked, then surely it shouldn't matter if the access check has passed?

CommentFileSizeAuthor
#2 access_check_xor-2872371-2.patch1.21 KBLOBsTerr
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

joachim created an issue. See original summary.

LOBsTerr’s picture

LOBsTerr CreditAttribution: LOBsTerr at European Commission and European Union Institutions, Agencies and Bodies commented
Status: Active » Needs review
FileSize
access_check_xor-2872371-2.patch1.21 KB

I agree it should be xor