An entry in user_badges.links.task.yml is missing for /user/{user}/badges. When this is added, the access check can fail on adjacent tabs such as for userpoints. In some cases $user_from_url is the user entity and in others it is simply the string of the user id. I've created a patch that makes these changes and uses dependency injection.

CommentFileSizeAuthor
#3 interdiff-3110467-1-3.patch1.7 KBmohit_aghera
#3 missing-and-broken-access-check-3110467-3.patch4.16 KBmohit_aghera
#2 missing-and-broken-access-check-3110467-1.patch3.17 KBjohne

Comments

johne created an issue. See original summary.

johne’s picture

johne commented
StatusFileSize
new missing-and-broken-access-check-3110467-1.patch3.17 KB

Here's that patch

mohit_aghera’s picture

mohit_aghera commented
Status: Active » Needs review
StatusFileSize
new missing-and-broken-access-check-3110467-3.patch4.16 KB
new interdiff-3110467-1-3.patch1.7 KB

Thanks @johne for initiating the patch.
The patch is working as expected. However, as per latest namespacing change for access related classes, I've refactored it.
I've updated the patch.
Code is essentially the same, I've just moved it as per namespace changes.

  • mohit_aghera committed b5dd308 on 8.x-1.x 
    Issue #3110467 by mohit_aghera, johne: missing and broken access check...
mohit_aghera’s picture

mohit_aghera commented
Status: Needs review » Fixed

Merging it for now.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.