Commit 358d2c72 authored by catch's avatar catch
Browse files

fix: #3626740 AccessManager should (once again) bail out early to save... 

fix: #3626740 AccessManager should (once again) bail out early to save resources and avoid adding cacheable metadata for no reason

By: kristiaanvandeneynde
By: graber
(cherry picked from commit 528d4178)
parent 2ae3db67

core/lib/Drupal/Core/Access/AccessManager.php

+7 −0
Changes for core/lib/Drupal/Core/Access/AccessManager.php: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -134,6 +134,13 @@ public function check(RouteMatchInterface $route_match, ?AccountInterface $accou 
      $result = AccessResult::allowed();

      foreach ($checks as $service_id) {

        $result = $result->andIf($this->performCheck($service_id, $arguments_resolver));

        // Stop as soon as the first non-allowed check is encountered. Neutral

        // or forbidden results will always deny access in the end, so there is

        // no need to run any extra code or add any extra cacheability after we

        // know the route will be inaccessible.

        if (!$result->isAllowed()) {

          break;

        }

      }

    }

    return $return_as_object ? $result : $result->isAllowed();

core/modules/ckeditor5/tests/src/Functional/MediaEntityMetadataApiTest.php

+2 −3
Changes for core/modules/ckeditor5/tests/src/Functional/MediaEntityMetadataApiTest.php: 2 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -264,12 +264,11 @@ public function testApi(): void { 
    $this->drupalGet($path, ['query' => ['uuid' => '🦙', 'token' => $token]]);

    $this->assertSession()->statusCodeEquals(400);



    // Ensure that users that don't have access to the filter format receive

    // either 404 or 403.

    // Ensure that users without access to the filter format receive 403.

    $this->drupalLogout();

    $token = $this->container->get('csrf_token')->get(ltrim($path, '/'));

    $this->drupalGet($path, ['token' => $token]);

    $this->assertSession()->statusCodeEquals(400);

    $this->assertSession()->statusCodeEquals(403);



    $this->drupalGet($path, ['query' => ['uuid' => $uuid, 'token' => $token]]);

    $this->assertSession()->statusCodeEquals(403);

core/profiles/demo_umami/tests/src/FunctionalJavascript/OpenTelemetryPerformanceTestAssertions/administratorNodePage.yml

+4 −4
Changes for core/profiles/demo_umami/tests/src/FunctionalJavascript/OpenTelemetryPerformanceTestAssertions/administratorNodePage.yml: 4 added lines, 4 removed lines.
Original line number Diff line number Diff line 
QueryCount: 264

CacheGetCount: 259

QueryCount: 261

CacheGetCount: 258

CacheGetCountByBin:

  config: 55

  bootstrap: 15
@@ -11,8 +11,8 @@ CacheGetCountByBin: 
  routes: 16

  render: 17

  file_parsing: 2

  menu: 22

CacheSetCount: 267

  menu: 21

CacheSetCount: 266

CacheDeleteCount: 0

CacheTagInvalidationCount: 0

CacheTagLookupQueryCount: 30