Problem/Motivation

The "Referenced entity" source reads the entities of a reference field without checking that the user may view that field. Field formatters check it, like core does before a formatter runs. When a module restricts field access (Field Permissions, hook_entity_field_access()), the values of the referenced entities are shown to users who cannot see the field. Access to each referenced entity is still checked, so only entities the user may view are exposed.

Steps to reproduce

1. Deny view access to an entity reference field with hook_entity_field_access().
2. Map a prop or slot to "Referenced entity" > any field of the referenced entity.
3. View the entity as a user without access to the field: the value is shown.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

just_like_good_vibes created an issue. See original summary.

just_like_good_vibes’s picture

Assigned: just_like_good_vibes » Unassigned
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.