Commit 206a3ac2 authored by catch's avatar catch
Browse files

Issue #3458403 by mstrelan: Conditionally disable access to update manager routes 

(cherry picked from commit 7f878e8e)
(cherry picked from commit 764b6cb7)
parent cf46b0dc

core/modules/update/src/Routing/UpdateRouteSubscriber.php

0 → 100644
+46 −0
Original line number Diff line number Diff line 
<?php



declare(strict_types=1);



namespace Drupal\update\Routing;



use Drupal\Core\Routing\RouteSubscriberBase;

use Drupal\Core\Site\Settings;

use Symfony\Component\Routing\RouteCollection;



/**

 * Route subscriber for Update module routes.

 */

class UpdateRouteSubscriber extends RouteSubscriberBase {



  /**

   * Constructs a new UpdateRouteSubscriber.

   */

  public function __construct(

    protected Settings $settings,

  ) {

  }



  /**

   * {@inheritdoc}

   */

  protected function alterRoutes(RouteCollection $collection) {

    if ($this->settings->get('allow_authorize_operations', TRUE)) {

      return;

    }

    $routes = [

      'update.report_install',

      'update.report_update',

      'update.module_install',

      'update.module_update',

      'update.theme_install',

      'update.theme_update',

      'update.confirmation_page',

    ];

    foreach ($routes as $route) {

      $route = $collection->get($route);

      $route->setRequirement('_access', 'FALSE');

    }

  }



}

core/modules/update/update.routing.yml

+0 −7
Original line number Diff line number Diff line
@@ -30,7 +30,6 @@ update.report_install: 
    _title: 'Add new module or theme'

  requirements:

    _permission: 'administer software updates'

    _access_update_manager: 'TRUE'



update.report_update:

  path: '/admin/reports/updates/update'
@@ -39,7 +38,6 @@ update.report_update: 
    _title: 'Update'

  requirements:

    _permission: 'administer software updates'

    _access_update_manager: 'TRUE'



update.module_install:

  path: '/admin/modules/install'
@@ -48,7 +46,6 @@ update.module_install: 
    _title: 'Add new module'

  requirements:

    _permission: 'administer software updates'

    _access_update_manager: 'TRUE'



update.module_update:

  path: '/admin/modules/update'
@@ -57,7 +54,6 @@ update.module_update: 
    _title: 'Update'

  requirements:

    _permission: 'administer software updates'

    _access_update_manager: 'TRUE'



update.theme_install:

  path: '/admin/theme/install'
@@ -66,7 +62,6 @@ update.theme_install: 
    _title: 'Add new theme'

  requirements:

    _permission: 'administer software updates'

    _access_update_manager: 'TRUE'



update.theme_update:

  path: '/admin/appearance/update'
@@ -75,7 +70,6 @@ update.theme_update: 
    _title: 'Update'

  requirements:

    _permission: 'administer software updates'

    _access_update_manager: 'TRUE'



# @todo Deprecate this route once

#   https://www.drupal.org/project/drupal/issues/3159210 is fixed, or remove
@@ -97,4 +91,3 @@ update.confirmation_page: 
    _title: 'Ready to update'

  requirements:

    _permission: 'administer software updates'
 
    _access_update_manager: 'TRUE'

core/modules/update/update.services.yml

+3 −0
Original line number Diff line number Diff line
@@ -22,3 +22,6 @@ services: 
  logger.channel.update:

    parent: logger.channel_base

    arguments: [ 'update' ]

  update.route_subscriber:

    class: Drupal\update\Routing\UpdateRouteSubscriber

    arguments: ['@settings']