Issue #3386313 by kksandr: Fixed access check in entity label formatter

Closes #3386313

core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php

@@ -2,6 +2,7 @@
 
 namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
 
+use Drupal\Core\Cache\CacheableMetadata;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\Exception\UndefinedLinkTemplateException;
 use Drupal\Core\Field\Attribute\FieldFormatter;
@@ -61,7 +62,9 @@ public function viewElements(FieldItemListInterface $items, $langcode) {
     $output_as_link = $this->getSetting('link');
 
     foreach ($this->getEntitiesToView($items, $langcode) as $delta => $entity) {
+      $elements[$delta] = ['#entity' => $entity];
       $label = $entity->label();
+      $cacheability = CacheableMetadata::createFromObject($entity);
       // If the link is to be displayed and the entity has a uri, display a
       // link.
       if ($output_as_link && !$entity->isNew()) {
@@ -74,31 +77,38 @@ public function viewElements(FieldItemListInterface $items, $langcode) {
           // entity type doesn't have a link template nor a valid
           // "uri_callback", so don't bother trying to output a link for the
           // rest of the referenced entities.
-          $output_as_link = FALSE;
+          $elements[$delta]['#plain_text'] = $label;
+          $cacheability->applyTo($elements[$delta]);
+          continue;
         }
-      }
 
-      if ($output_as_link && isset($uri) && !$entity->isNew()) {
-        $elements[$delta] = [
-          '#type' => 'link',
-          '#title' => $label,
-          '#url' => $uri,
-          '#options' => $uri->getOptions(),
-        ];
+        $uri_access = $uri->access(return_as_object: TRUE);
+        $cacheability->addCacheableDependency($uri_access);
+        if ($uri_access->isAllowed()) {
+          $elements[$delta] += [
+            '#type' => 'link',
+            '#title' => $label,
+            '#url' => $uri,
+            '#options' => $uri->getOptions(),
+          ];
 
-        if (!empty($items[$delta]->_attributes)) {
-          $elements[$delta]['#options'] += ['attributes' => []];
-          $elements[$delta]['#options']['attributes'] += $items[$delta]->_attributes;
-          // Unset field item attributes since they have been included in the
-          // formatter output and shouldn't be rendered in the field template.
-          unset($items[$delta]->_attributes);
+          if (!empty($items[$delta]->_attributes)) {
+            $elements[$delta]['#options'] += ['attributes' => []];
+            $elements[$delta]['#options']['attributes'] += $items[$delta]->_attributes;
+            // Unset field item attributes since they have been included in the
+            // formatter output and shouldn't be rendered in the field template.
+            unset($items[$delta]->_attributes);
+          }
+        }
+        else {
+          $elements[$delta]['#plain_text'] = $label;
         }
       }
       else {
-        $elements[$delta] = ['#plain_text' => $label];
+        $elements[$delta]['#plain_text'] = $label;
       }
-      $elements[$delta]['#entity'] = $entity;
-      $elements[$delta]['#cache']['tags'] = $entity->getCacheTags();
+
+      $cacheability->applyTo($elements[$delta]);
     }
 
     return $elements;