The current logic will grant access to another user's unpublished entity, if the user has a "view any $entity_type" permission.
This is incorrect, "view any" is still limited to published entities. It also doesn't match what EntityAccessControlHandler is doing.

Fix incoming.

Comments

bojanz created an issue. See original summary.

  • bojanz committed bbeeb0b on 8.x-1.x 
    Issue #2977379 by bojanz: UncacheableEntityAccessControlHandler::...
bojanz’s picture

bojanz CreditAttribution: bojanz at Centarro commented
Status: Active » Fixed

Fixed.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.