Verified Commit ee08ccf7 authored by Jess's avatar Jess
Browse files

SA-CORE-2022-009 by kristiaanvandeneynde, larowlan, acbramley, xjm, longwave,... 

SA-CORE-2022-009 by kristiaanvandeneynde, larowlan, acbramley, xjm, longwave, catch, jibran, benjifisher

(cherry picked from commit ab1107a4)
parent 077fd519

core/modules/media/src/MediaAccessControlHandler.php

+1 −1
Original line number Diff line number Diff line
@@ -131,7 +131,7 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter 
        $media_storage = $this->entityTypeManager->getStorage($entity->getEntityTypeId());

        $access = $this->access($media_storage->load($entity->id()), 'view', $account, TRUE);

        if (!$entity->isDefaultRevision()) {

          $access = $access->orIf($this->access($entity, 'view', $account, TRUE));

          $access = $access->andIf($this->access($entity, 'view', $account, TRUE));

        }

        return $access->cachePerPermissions()->addCacheableDependency($entity);

core/modules/node/src/NodeAccessControlHandler.php

+3 −3
Original line number Diff line number Diff line
@@ -137,7 +137,7 @@ protected function checkAccess(EntityInterface $node, $operation, AccountInterfa 
      return AccessResult::allowed()->cachePerPermissions()->cachePerUser()->addCacheableDependency($node);

    }



    [$revision_permission_operation] = static::REVISION_OPERATION_MAP[$operation] ?? [

    [$revision_permission_operation, $entity_operation] = static::REVISION_OPERATION_MAP[$operation] ?? [

      NULL,

      NULL,

    ];
@@ -169,9 +169,9 @@ protected function checkAccess(EntityInterface $node, $operation, AccountInterfa 
      // node passed in is not the default revision then check access to

      // that, too.

      $node_storage = $this->entityTypeManager->getStorage($node->getEntityTypeId());

      $access = $this->access($node_storage->load($node->id()), 'view', $account, TRUE);

      $access = $this->access($node_storage->load($node->id()), $entity_operation, $account, TRUE);

      if (!$node->isDefaultRevision()) {

        $access = $access->orIf($this->access($node, 'view', $account, TRUE));

        $access = $access->andIf($this->access($node, $entity_operation, $account, TRUE));

      }

      return $access->cachePerPermissions()->addCacheableDependency($node);

    }