Replace the default _access_checks(access mode) with ALL instead of ANY

+++ b/core/modules/rest/lib/Drupal/rest/Plugin/ResourceBase.php
@@ -92,6 +92,8 @@ public function routes() {
         // The HTTP method is a requirement for this route.
         '_method' => $method,
         '_permission' => "restful $lower_method $this->pluginId",
+      ), array(
+        '_access_mode' => 'ANY',
       ));

Is this really correct?

Shouldn't this be ALL and be only dependent on _permission?

I'm not familiar with the REST module code, but I see there's access checks happening on _method as well. Though it shouldn't apply here because _access_rest_csrf isn't set. I'm not aware of the full scope of what's happening, but in any case, ANY seems wrong.

If I'm wrong, care to explain why? :)

Didn't mean to mark this NW.

_method is not enforced by an access checker but by UrlMatcher. _access_mode is entirely irrelevant for that.

#3: access-2063401-3.patch queued for re-testing.

How do we move this forward? Who is the most appropriate person to review this?

Fortunately I brought my laptop with me to Minneapolis. :-)

I was confused about Daniel's comment in #8. I guess that's not actually an issue anymore then? :)

Otherwise, +1 on this.

#3: access-2063401-3.patch queued for re-testing.

Patch no longer applies.

And back again.

d.o tag monster

#20: access-2063401-20.patch queued for re-testing.

Two of the recent additions needed ANY.

I would've expected this patch to also kill all of the unnecessary "ALL"s. Is that possible?

#29 is addressed so back to RTBC.

needs reroll after #2089671: Convert non-test form callbacks to new form controller

Moving back to RTBC, since that's where it was before testbot failed it.

Just one missing in the ContentTranslationRouteSubscriber I think. This is when you have to love test coverage.

This should go back to RTBC if/when this passes.

#41: 2063401-41.patch queued for re-testing.

+1 from me too.

Patch no longer applies.

rerolled. The hunk from router_test.routing.yml is already in HEAD:

+  options:
+    _access_mode: 'ANY'

Awesome, thank you SO much for this patch!

Committed and pushed to 8.x. Thanks!

Needs a change notice.

Fixed the change notice title and added some examples.

jibran++

Oops, this change caused a security issue in rest.module: #2420559: REST permissions are not working as expected..