Problem/Motivation

There is no need to check access for entityQuery of user in user_is_blocked function.

Under normal circumstances, it's OK with access check. But for some reason, like if you install group module, it will alter the query by checking the current user's group permissions. Finally, it cannot find any blocked user if the blocked user belong to any group.
So it will let the blocked user login successfully and later logout him when user login Drupal.

Proposed resolution

Set access check to FALSE for entityQuery of user in user_is_blocked function

function user_is_blocked($name) {
  return (bool) \Drupal::entityQuery('user')
    ->accessCheck(FALSE)
    ->condition('name', $name)
    ->condition('status', 0)
    ->execute();
}
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

yechaozheng created an issue. See original summary.

yechaozheng’s picture

Assigned: yechaozheng » Unassigned
Status: Needs work » Needs review
FileSize
444 bytes

Create a patch for it.

longwave’s picture

Version: 8.8.x-dev » 8.9.x-dev
Status: Needs review » Reviewed & tested by the community

This is a backport of #3203366: EntityQuery accessCheck: user_is_blocked() should not be access sensitive and the patch is identical, however 8.8.x is no longer supported and this can only be committed to 8.9.x.

renatog’s picture

It works well. +1 to it

  • catch committed 8bdcc82 on 8.9.x
    Issue #3206540 by yechaozheng, longwave: Set access check to FALSE for...
catch’s picture

Priority: Normal » Major
Status: Reviewed & tested by the community » Fixed

We're only backporting major and critical bugs to 8.9.x now, but this is arguably major, so bumping priority.
Committed 8bdcc82 and pushed to 8.9.x. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.