Issue #3228503 by omarlopesino: Flag counts are not checking user access in user flagging counts

Issue #3228503 by omarlopesino: Flag counts are not checking user access in user flagging counts

src/FlagCountManager.php

@@ -5,6 +5,7 @@ namespace Drupal\flag;
 use Drupal\Component\Datetime\TimeInterface;
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\flag\Event\FlagEvents;
 use Drupal\flag\Event\FlaggingEvent;
@@ -59,12 +60,20 @@ class FlagCountManager implements FlagCountManagerInterface, EventSubscriberInte
    */
   protected $dateTime;
 
+  /**
+   * Check the access of each entity obtained in the counts.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
   /**
    * Constructs a FlagCountManager.
    */
-  public function __construct(Connection $connection, TimeInterface $date_time) {
+  public function __construct(Connection $connection, TimeInterface $date_time, EntityTypeManagerInterface $entityTypeManager) {
     $this->connection = $connection;
     $this->dateTime = $date_time;
+    $this->entityTypeManager = $entityTypeManager;
   }
 
   /**
@@ -73,7 +82,8 @@ class FlagCountManager implements FlagCountManagerInterface, EventSubscriberInte
   public static function create(ContainerInterface $container) {
     return new self(
       $container->get('database'),
-      $container->get('datetime.time')
+      $container->get('datetime.time'),
+      $container->get('entity_type.manager')
     );
   }
 
@@ -168,22 +178,30 @@ class FlagCountManager implements FlagCountManagerInterface, EventSubscriberInte
       $query->condition('session_id', $session_id);
     }
 
-    $query->addExpression('COUNT(*)');
+    $query->fields('f', ['entity_type', 'entity_id']);
 
     $result = $query->execute()
-      ->fetchField();
+      ->fetchAll();
+
+    $count = 0;
+    foreach ($result as $row) {
+      $entity = $this->entityTypeManager->getStorage($row->entity_type)->load($row->entity_id);
+      if ($entity->access('view', $user)) {
+        $count++;
+      }
+    }
 
     // Cache the result.
     if ($get_by_session_id) {
       // Cached by flag, by uid and by session_id.
-      $this->userFlagCounts[$flag_id][$uid][$session_id] = $result;
+      $this->userFlagCounts[$flag_id][$uid][$session_id] = $count;
     }
     else {
       // Cached by flag, by uid.
-      $this->userFlagCounts[$flag_id][$uid] = $result;
+      $this->userFlagCounts[$flag_id][$uid] = $count;
     }
 
-    return $result;
+    return $count;
   }
 
   /**