Let's start to convert all calls to user_access() with the new AccountInterface::hasPermission() method.

Part of #2048171: [meta] Replace user_access() calls with $account->hasPermission() wherever possible.

Change records for this issue:

CommentFileSizeAuthor
#6 2062023-statistics-replace-user_access-calls-6.patch1.52 KBrhm5000
#6 interdiff-2062023-3-6.txt894 bytesrhm5000
#3 2062023-statistics-replace-user_access-calls-3.patch1.51 KBrhm5000
#3 interdiff-2062023-1-3.txt1.64 KBrhm5000
#1 drupal-statistics_replace_user_access-2062023.patch1.59 KBInternetDevels
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

InternetDevels’s picture

InternetDevels CreditAttribution: InternetDevels commented
Status: Active » Needs review
FileSize
drupal-statistics_replace_user_access-2062023.patch1.59 KB

Here is the patch.

andypost’s picture

andypost
he/him
Primary language Russian
CreditAttribution: andypost commented
Status: Needs review » Needs work 
  1. +++ b/core/modules/statistics/lib/Drupal/statistics/Plugin/Block/StatisticsPopularBlock.php
@@ -58,7 +58,7 @@ public function settings() {
+    if (\Drupal::request()->attributes->get('_account')->hasPermission('access content')) {

    Suppose blocks should use current_user service via injection 

  2. +++ b/core/modules/statistics/statistics.module
@@ -58,7 +58,8 @@ function statistics_node_view(EntityInterface $node, EntityDisplay $display, $vi
+    $account = Drupal::request()->attributes->get('_account');

    Drupal::currentUser()->hasPermission('view post access counter')

rhm5000’s picture

rhm5000 CreditAttribution: rhm5000 commented
Status: Needs work » Needs review
FileSize
interdiff-2062023-1-3.txt1.64 KB
2062023-statistics-replace-user_access-calls-3.patch1.51 KB

Status: Needs review » Needs work

The last submitted patch, 2062023-statistics-replace-user_access-calls-3.patch, failed testing.

andypost’s picture

andypost
he/him
Primary language Russian
CreditAttribution: andypost commented 
+++ b/core/modules/statistics/lib/Drupal/statistics/Plugin/Block/StatisticsPopularBlock.php
@@ -57,7 +57,7 @@ public function settings() {
+    if (Drupal::currentUser()->hasPermission('access content')) {

This needs '\' before Drupal at least

rhm5000’s picture

rhm5000 CreditAttribution: rhm5000 commented
Status: Needs work » Needs review
FileSize
interdiff-2062023-3-6.txt894 bytes
2062023-statistics-replace-user_access-calls-6.patch1.52 KB
andypost’s picture

andypost
he/him
Primary language Russian
CreditAttribution: andypost commented
Status: Needs review » Reviewed & tested by the community

this could go, but I wish a maintainer should decide about the usage of \Drupal here.
Probably better to file new issue to pass $account to block access() method

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented

Yeah let's open an issue for that if there's not one already.

andypost’s picture

andypost
he/him
Primary language Russian
CreditAttribution: andypost commented

There's one #1951386: Extend BlockPluginInterface::access to allow passing in an account

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Status: Reviewed & tested by the community » Fixed

Committed/pushed to 8.x, thanks!

Automatically closed -- issue fixed for 2 weeks with no activity.