Verified Commit 0edb2442 authored by Dave Long's avatar Dave Long
Browse files

Issue #3395431 by acbramley, smustgrave, larowlan: BlockContent JSON:API... 

Issue #3395431 by acbramley, smustgrave, larowlan: BlockContent JSON:API collection endpoint doesn't return unpublished block when filtered without administer block content permission

(cherry picked from commit 257191b8)
parent 35da18cb

core/modules/jsonapi/jsonapi.module

+1 −0
Original line number Diff line number Diff line
@@ -183,6 +183,7 @@ function jsonapi_jsonapi_block_content_filter_access(EntityTypeInterface $entity 
  // \Drupal\jsonapi\Access\TemporaryQueryGuard adds the condition for

  // (isReusable()), so this does not have to.

  return ([

    JSONAPI_FILTER_AMONG_ALL => AccessResult::allowedIfHasPermission($account, 'access block library'),

    JSONAPI_FILTER_AMONG_PUBLISHED => AccessResult::allowed(),

  ]);

}

core/modules/jsonapi/tests/src/Functional/BlockContentTest.php

+13 −0
Original line number Diff line number Diff line
@@ -68,6 +68,11 @@ class BlockContentTest extends ResourceTestBase { 
  protected function setUpAuthorization($method) {

    switch ($method) {

      case 'GET':

        $this->grantPermissionsToTestedRole([

          'access block library',

        ]);

        break;



      case 'PATCH':

        $this->grantPermissionsToTestedRole([

          'access block library',
@@ -86,6 +91,14 @@ protected function setUpAuthorization($method) { 
    }

  }



  /**

   * {@inheritdoc}

   */

  protected function setUpRevisionAuthorization($method) {

    parent::setUpRevisionAuthorization($method);

    $this->grantPermissionsToTestedRole(['view any basic block content history']);

  }



  /**

   * {@inheritdoc}

   */