Exposing a list of entities with the FieldItemListNormalizer will expose all entities regardless of user access.

CommentFileSizeAuthor
#6 add-access-check-field-item-list-3160617-3.patch1 KB_kash_
#5 add-access-check-field-item-list-3160617-2.patch950 bytes_kash_
#3 add-access-check-field-item-list-3160617-1.patch670 bytes_kash_

Comments

_KASH_ created an issue. See original summary.

_kash_’s picture

_kash_ commented

I have a patch for this I am going to add.

_kash_’s picture

_kash_ commented
StatusFileSize
new add-access-check-field-item-list-3160617-1.patch670 bytes
_kash_’s picture

_kash_ commented
Assigned: _kash_ » Unassigned
Status: Active » Needs review
_kash_’s picture

_kash_ commented
StatusFileSize
new add-access-check-field-item-list-3160617-2.patch950 bytes
_kash_’s picture

_kash_ commented
StatusFileSize
new add-access-check-field-item-list-3160617-3.patch1 KB

This patch attempts to handle cardinality and return null appropriately.

  • geoanders committed 4a7c9ca on 8.x-2.x 
    Issue #3160617 by _KASH_: FieldItemListNormalizer does not check access...
geoanders’s picture

geoanders commented
Version: 8.x-1.0 » 8.x-2.x-dev
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.