Commit 76ba77c8 authored by catch's avatar catch
Browse files

Issue #2053015 by smustgrave, hydra, hgoto, acbramley, ranjith_kumar_k_u,... 

Issue #2053015 by smustgrave, hydra, hgoto, acbramley, ranjith_kumar_k_u, dawehner, lauriii, quietone, bdone: Add user access checks to 'more' link
parent 7c7c2c27

core/modules/views/src/Plugin/views/display/DisplayPluginBase.php

+6 −1
Original line number Diff line number Diff line
@@ -2117,13 +2117,18 @@ public function renderMoreLink() { 
    $hasMoreRecords = !empty($this->view->pager) && $this->view->pager->hasMoreRecords();

    if ($this->isMoreEnabled() && ($this->useMoreAlways() || $hasMoreRecords)) {

      $url = $this->getMoreUrl();

      $access = $url->access(return_as_object: TRUE);



      return [

      $more_link = [

        '#type' => 'more_link',

        '#url' => $url,

        '#title' => $this->useMoreText(),

        '#view' => $this->view,

        '#access' => $access->isAllowed(),

      ];

      $accessCacheability = CacheableMetadata::createFromObject($access);

      $accessCacheability->applyTo($more_link);

      return $more_link;

    }

  }

core/modules/views/tests/src/Functional/Plugin/DisplayTest.php

+8 −0
Original line number Diff line number Diff line
@@ -316,6 +316,14 @@ public function testReadMoreCustomURL(): void { 
    $output = $view->preview();

    $output = (string) $renderer->renderRoot($output);

    $this->assertStringContainsString('/node?date=22&foo=bar#22', $output, 'The read more link with href "/node?date=22&foo=bar#22" was found.');



    // Test more link isn't rendered if user doesn't have permission to the

    // more link URL.

    $view->display_handler->setOption('link_url', 'admin/content');

    $this->executeView($view);

    $output = $view->preview();

    $output = (string) $renderer->renderRoot($output);

    $this->assertStringNotContainsString('/admin/content', $output, 'The read more link with href "/admin/content" was not found.');

  }



  /**