Verified Commit 9a1d0b13 authored by Dave Long's avatar Dave Long
Browse files

Issue #3512116 by annmarysruthy, juandhr, larowlan, mstrelan, quietone:... 

Issue #3512116 by annmarysruthy, juandhr, larowlan, mstrelan, quietone: \Drupal\system\Controller\DbUpdateController::helpfulLinks checks hard-coded permissions but should check access on the url
parent 8326e01e

core/modules/system/src/Controller/DbUpdateController.php

+8 −4
Original line number Diff line number Diff line
@@ -705,16 +705,20 @@ protected function helpfulLinks(Request $request) { 
      'title' => $this->t('Front page'),

      'url' => Url::fromRoute('<front>')->setOption('base_url', $base_url),

    ];

    if ($this->account->hasPermission('access administration pages')) {



    $admin_url = Url::fromRoute('system.admin')->setOption('base_url', $base_url);

    if ($admin_url->access($this->account)) {

      $links['admin-pages'] = [

        'title' => $this->t('Administration pages'),

        'url' => Url::fromRoute('system.admin')->setOption('base_url', $base_url),

        'url' => $admin_url,

      ];

    }

    if ($this->account->hasPermission('administer site configuration')) {



    $status_report_url = Url::fromRoute('system.status')->setOption('base_url', $base_url);

    if ($status_report_url->access($this->account)) {

      $links['status-report'] = [

        'title' => $this->t('Status report'),

        'url' => Url::fromRoute('system.status')->setOption('base_url', $base_url),

        'url' => $status_report_url,

      ];

    }

    return $links;