Active
Project:
Drupal core
Version:
main
Component:
user.module
Priority:
Normal
Category:
Plan
Assigned:
Unassigned
Reporter:
Created:
5 Nov 2017 at 16:07 UTC
Updated:
29 Oct 2018 at 17:51 UTC
Jump to comment: Most recent
In D8, users are entities and so are subject to access control through functions such as hook_entity_access. This is a huge improvement over D7, but it's not fully working yet.
Expected behaviour: contrib/custom code can hook access and the user module automatically takes account of the result.
Actual behaviour: there are still some hard-coded calls to check the specific permissions defined by vanilla Drupal core - ignoring the customised access.
Hard-coded 'administer users':
Comments
Comment #2
adamps commentedComment #3
adamps commentedComment #4
adamps commentedComment #5
adamps commentedComment #6
adamps commentedComment #9
adamps commentedComment #10
adamps commentedComment #11
adamps commented