Just stumbled on this code: in node.module in node_node_access, the switch case for 'create' just falls through to the 'update' condition. This seems wrong in some way. I can think of scenarios where you are allowed to create content but not edit what you just have created. Or you are only allowed to edit content, not create it. The code as it is written now implies anyone with 'edit any' permissions is able to create content, since the 'create' permission is overruled.

switch ($op) {
    case 'create':
      $access = AccessResult::allowedIfHasPermission($account, 'create ' . $type . ' content');

    case 'update':
      $access = AccessResult::allowedIfHasPermission($account, 'edit any ' . $type . ' content');
      if (!$access->isAllowed() && $account->hasPermission('edit own ' . $type . ' content')) {
        $access = $access->orIf(AccessResult::allowedIf($account->id() == $node->getOwnerId())->cachePerUser()->addCacheableDependency($node));
      }
      break;

Comments

kriboogh created an issue. See original summary.

kriboogh’s picture

Issue summary: View changes
init90’s picture

Hi, @kriboogh

It really looks like a mistake and certainly 'create' case hunk should have 'break' statement but in the current case, all not so obvious because we have #2348203: hook_node_access() no longer fires for the 'create' operation according to it the 'create' operation never fires in hook_node_access.

Hence the problem described here not fully actual, but certainly, the behavior should be clear and how I see #2348203: hook_node_access() no longer fires for the 'create' operation will bring needed clarification.
So I think the issue can be closed in favor of #2348203: hook_node_access() no longer fires for the 'create' operation.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

init90’s picture

Status: Active » Closed (duplicate)

#2348203: hook_node_access() no longer fires for the 'create' operation was committed so the issue not actual anymore and can be closed.