The "link to any page" permission is no longer required to administer menu links for routes they cannot access

Until this change, a user that was able to administer menu links (i.e. granted with administer menu permission), was not able to administer links whose route they cannot access, unless they're also granted with link to any page permission.

Now, a user with the administer menu permission, using the Menu UI form, can manage links pointing to routes that they cannot access, such as the login link or a link to a page that doesn't exist yet, even if they are not granted with the link to any page permission.

Background

Until this change, a user granted with the link to any page permission was able to see any link, regardless if they were able to access the route. For example the login route is not accessible by logged-in users but a user granted with the link to any page permission (or the super-user) was able to see a link routed to login route. This was a bug because the access to a routed menu link should follow the access to the route.

However, there are circumstances when a site builder should be able to administer routed menu links, even they are not able to access the underlying route. This is the case with Menu UI module, when a user granted with the administer menu permission should be able to manage such menu links. Some use cases:

• A login menu link, routed to the user.login route, is not accessible to a logged in user, but the site builder still needs to configure the menu link.
• A site builder wants to add a menu link for a Views page that is not yet created, thus there's no access to the route, as the route doesn't exist.
• A menu administrator should be allowed to create an /about menu link even the target page doesn't exist yet.

Changes

Users granted with administer menu permission are able to administer menu links even their access to those link routes is denied.