[D8] Country, State and City Fields

Thank you for applying! Remember to change status, when the project is ready for review, as in this queue Active means Don't review yet the project I am using for this application.

1. CityListAccessControlHandler::checkAccess(): do not use \Drupal::currentUser() to check for access. Use the passed in $account object. That is the one that the access check should be performed on. Please check all your access controller methods to not use the global user if possible.
2. There are quite a few doc blocks that read "Undocumented function.". Please add proper comments to all your methods.
3. class CountrySettingsForm: the docblock just repeats the class name which is not useful. Please describe what the class is used for and why. Please check all your doc blocks.

Otherwise looks good to me.

Thanks for your contribution, Arun!

I updated your account so you can opt into security advisory coverage now.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.

Given that this application has never been set to Needs work and that given access to a user who would not have it is a serious issue, the OP is required to make the changes reported in the previous comment, since that is a misuse of Drupal API.

An application does not have to be set to "needs work" if there is nothing blocking approval :-)

Using the global user is bad, but I do not see a security issue in this case because it cannot be exploited.

Anyway, @arunkumarkit please fix the mentioned issues and then we can approve this for real.

The issue is that what checkAccess() implemented from an access control handler gets as argument is not necessarily the user object for the currently logged-in user. If the code assumes that, and uses the value returned from \Drupal::currentUser() instead of the argument it gets, it will check the access for the wrong user object. This is as wrong as checking for the wrong user permission.

The change is fine, for me. See comment #4 for the other suggestions, which (by themselves) aren't reasons to keep the status on Needs work.