Commit c704db94 authored by catch's avatar catch
Browse files

Issue #3311563 by stefanos.petrakis, rpayanm, smustgrave, longwave, Wim Leers:... 

Issue #3311563 by stefanos.petrakis, rpayanm, smustgrave, longwave, Wim Leers: Safeguarding against UnblockUser::execute()'s method unblocking the anonymous user
parent a49a8f24

core/modules/user/src/AccountForm.php

+1 −1
Original line number Diff line number Diff line
@@ -72,7 +72,7 @@ public function form(array $form, FormStateInterface $form_state) { 
    $language_interface = \Drupal::languageManager()->getCurrentLanguage();



    // Check for new account.

    $register = $account->isAnonymous();

    $register = $account->isNew();



    // For a new account, there are 2 sub-cases:

    // $self_register: A user creates their own, new, account

core/modules/user/src/Entity/User.php

+4 −1
Original line number Diff line number Diff line
@@ -305,6 +305,9 @@ public function isBlocked() { 
   * {@inheritdoc}

   */

  public function activate() {

    if ($this->isAnonymous()) {

      throw new \LogicException('The anonymous user account should remain blocked at all times.');

    }

    $this->get('status')->value = 1;

    return $this;

  }
@@ -370,7 +373,7 @@ public function isAuthenticated() { 
   * {@inheritdoc}

   */

  public function isAnonymous() {

    return $this->id() == 0;

    return $this->id() === 0 || $this->id() === '0';

  }



  /**

core/modules/user/src/UserAccessControlHandler.php

+1 −1
Original line number Diff line number Diff line
@@ -101,7 +101,7 @@ protected function checkFieldAccess($operation, FieldDefinitionInterface $field_ 
      case 'name':

        // Allow view access to anyone with access to the entity.

        // The username field is editable during the registration process.

        if ($operation == 'view' || ($items && $items->getEntity()->isAnonymous())) {

        if ($operation == 'view' || ($items && $items->getEntity()->isNew())) {

          return AccessResult::allowed()->cachePerPermissions();

        }

        // Allow edit access for the own user name if the permission is

core/modules/user/tests/src/Kernel/UserAccountFormFieldsTest.php

+18 −5
Original line number Diff line number Diff line
@@ -4,6 +4,8 @@ 


use Drupal\Core\Form\FormState;

use Drupal\KernelTests\KernelTestBase;

use Drupal\user\Entity\User;

use Drupal\user\UserInterface;



/**

 * Verifies that the field order in user account forms is compatible with
@@ -20,6 +22,11 @@ class UserAccountFormFieldsTest extends KernelTestBase { 
   */

  protected static $modules = ['system', 'user', 'field'];



  /**

   * @var \Drupal\user\UserInterface

   */

  protected UserInterface $user;



  /**

   * Tests the root user account form section in the "Configure site" form.

   */
@@ -72,6 +79,10 @@ public function testUserRegistrationForm() { 
  public function testUserEditForm() {

    // Install default configuration; required for AccountFormController.

    $this->installConfig(['user']);

    $this->installEntitySchema('user');



    $this->user = User::create(['name' => 'test']);

    $this->user->save();



    $form = $this->buildAccountForm('default');
@@ -127,13 +138,15 @@ protected function assertFieldOrder(array $elements): void { 
  protected function buildAccountForm($operation) {

    // @see HtmlEntityFormController::getFormObject()

    $entity_type = 'user';

    $fields = [];

    if ($operation != 'register') {

      $fields['uid'] = 2;

      // Use an existing user.

      $entity = $this->user;

    }

    else {

      $entity = $this->container->get('entity_type.manager')

        ->getStorage($entity_type)

      ->create($fields);

        ->create();

    }



    // @see EntityFormBuilder::getForm()

    return $this->container->get('entity.form_builder')->getForm($entity, $operation);

core/modules/user/tests/src/Kernel/UserAccountFormPasswordResetTest.php

+6 −5
Original line number Diff line number Diff line
@@ -87,13 +87,14 @@ public function testPasswordResetToken() { 
  protected function buildAccountForm($operation) {

    // @see HtmlEntityFormController::getFormObject()

    $entity_type = 'user';

    $fields = [];

    if ($operation != 'register') {

      $fields['uid'] = $this->user->id();

      $entity = $this->user;

    }

    else {

      $entity = $this->container->get('entity_type.manager')

        ->getStorage($entity_type)

      ->create($fields);

        ->create();

    }



    // @see EntityFormBuilder::getForm()

    return $this->container->get('entity.form_builder')->getForm($entity, $operation);