Verified Commit 04c5013c authored by Dave Long's avatar Dave Long
Browse files

Issue #3395404 by acbramley, larowlan, smustgrave, Berdir, jannakha, xjm:... 

Issue #3395404 by acbramley, larowlan, smustgrave, Berdir, jannakha, xjm: Information disclosure access bypass for revision log fields when the JSON:API module is enabled

(cherry picked from commit 184f22ee)
parent 2ec2791a

core/lib/Drupal/Core/Entity/EntityAccessControlHandler.php

+11 −0
Original line number Diff line number Diff line
@@ -389,6 +389,17 @@ function (callable $hook, string $module) use ($operation, $field_definition, $a 
   *   The access result.

   */

  protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) {

    if (!$items instanceof FieldItemListInterface || $operation !== 'view') {

      return AccessResult::allowed();

    }

    $entity = $items->getEntity();

    $isRevisionLogField = $this->entityType instanceof ContentEntityTypeInterface && $field_definition->getName() === $this->entityType->getRevisionMetadataKey('revision_log_message');

    if ($entity && $isRevisionLogField) {

      // The revision log should only be visible to those who can view the

      // revisions OR edit the entity.

      return $entity->access('view revision', $account, TRUE)

        ->orIf($entity->access('update', $account, TRUE));

    }

    return AccessResult::allowed();

  }

core/modules/block_content/src/BlockContentAccessControlHandler.php

+1 −1
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter 
        'update' => AccessResult::allowedIfHasPermission($account, 'edit any ' . $bundle . ' block content'),

        'delete' => AccessResult::allowedIfHasPermission($account, 'delete any ' . $bundle . ' block content'),

        // Revisions.

        'view all revisions' => AccessResult::allowedIfHasPermission($account, 'view any ' . $bundle . ' block content history'),

        'view revision', 'view all revisions' => AccessResult::allowedIfHasPermission($account, 'view any ' . $bundle . ' block content history'),

        'revert' => AccessResult::allowedIfHasPermission($account, 'revert any ' . $bundle . ' block content revisions')

          ->orIf($forbidIfNotReusable()),

        'delete revision' => AccessResult::allowedIfHasPermission($account, 'delete any ' . $bundle . ' block content revisions')

core/modules/block_content/tests/src/Kernel/BlockContentAccessHandlerTest.php

+25 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
use Drupal\Core\Access\AccessResultNeutral;

use Drupal\Core\Access\AccessResultReasonInterface;

use Drupal\KernelTests\KernelTestBase;

use Drupal\Tests\user\Traits\UserCreationTrait;

use Drupal\user\Entity\Role;

use Drupal\user\Entity\User;
@@ -23,6 +24,8 @@ 
 */

class BlockContentAccessHandlerTest extends KernelTestBase {



  use UserCreationTrait;



  /**

   * {@inheritdoc}

   */
@@ -592,4 +595,26 @@ public function providerTestAccess(): array { 
    return $cases;

  }



  /**

   * Tests revision log access.

   */

  public function testRevisionLogAccess(): void {

    $admin = $this->createUser([

      'administer block content',

      'access content',

    ]);

    $editor = $this->createUser([

      'access content',

      'access block library',

      'view any square block content history',

    ]);

    $viewer = $this->createUser([

      'access content',

    ]);



    $this->assertTrue($this->blockEntity->get('revision_log')->access('view', $admin));

    $this->assertTrue($this->blockEntity->get('revision_log')->access('view', $editor));

    $this->assertFalse($this->blockEntity->get('revision_log')->access('view', $viewer));

  }



}

core/modules/jsonapi/tests/src/Functional/BlockContentTest.php

+0 −1
Original line number Diff line number Diff line
@@ -162,7 +162,6 @@ protected function getExpectedDocument() { 
          ],

          'changed' => (new \DateTime())->setTimestamp($this->entity->getChangedTime())->setTimezone(new \DateTimeZone('UTC'))->format(\DateTime::RFC3339),

          'info' => 'Llama',

          'revision_log' => NULL,

          'revision_created' => (new \DateTime())->setTimestamp($this->entity->getRevisionCreationTime())->setTimezone(new \DateTimeZone('UTC'))->format(\DateTime::RFC3339),

          'revision_translation_affected' => TRUE,

          'status' => FALSE,

core/modules/jsonapi/tests/src/Functional/NodeTest.php

+0 −1
Original line number Diff line number Diff line
@@ -177,7 +177,6 @@ protected function getExpectedDocument() { 
            'langcode' => 'en',

          ],

          'promote' => TRUE,

          'revision_log' => NULL,

          'revision_timestamp' => '1973-11-29T21:33:09+00:00',

          // @todo Attempt to remove this in https://www.drupal.org/project/drupal/issues/2933518.

          'revision_translation_affected' => TRUE,