Entity edit-form routes check "update" access but not "view" access

Problem/Motivation

This issue has been cleared by the Drupal Security Team to be discussed in public.

Currently, it is possible for $entity->access('update') to return TRUE even when $entity->access('view') returns FALSE. An example is if someone has permission to "Article: Edit own content" and does not have permission to "View own unpublished content", then they are allowed to update an unpublished article that they cannot view.

Several potential problems arise from this:

• Does it make sense conceptually to be able to update something that you cannot view?
• Even if it makes sense conceptually, most edit forms show you the current field values of what you're editing. At which point, you're basically viewing whatever it is that someone decided to not give you permission to view.

Steps to reproduce

Proposed resolution

• Option 1: change nothing, consider this "by design".
• Option 2: change edit forms to require view access in addition to update access, but continue to allow non-form updates without view access, if those ways of updating don't disclose current values.
• Option 3: continue to allow updates via edit forms, even without view access, but in those cases change the forms to not disclose current values.
• Option 4: don't return TRUE from $entity->access('update') if $entity->access('view') isn't also TRUE.

Remaining tasks

Decide on one of the options, or come up with additional options.

User interface changes

API changes

Data model changes

Release notes snippet