An entry in user_badges.links.task.yml is missing for /user/{user}/badges. When this is added, the access check can fail on adjacent tabs such as for userpoints. In some cases $user_from_url is the user entity and in others it is simply the string of the user id. I've created a patch that makes these changes and uses dependency injection.

CommentFileSizeAuthor
#3 interdiff-3110467-1-3.patch1.7 KBmohit_aghera
#3 missing-and-broken-access-check-3110467-3.patch4.16 KBmohit_aghera
#2 missing-and-broken-access-check-3110467-1.patch3.17 KBjohne
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

johne created an issue. See original summary.

johne’s picture

johne CreditAttribution: johne at CivicActions for LINCS commented
FileSize
missing-and-broken-access-check-3110467-1.patch3.17 KB

Here's that patch

mohit_aghera’s picture

mohit_aghera CreditAttribution: mohit_aghera as a volunteer and at Axelerant commented
Status: Active » Needs review
FileSize
missing-and-broken-access-check-3110467-3.patch4.16 KB
interdiff-3110467-1-3.patch1.7 KB

Thanks @johne for initiating the patch.
The patch is working as expected. However, as per latest namespacing change for access related classes, I've refactored it.
I've updated the patch.
Code is essentially the same, I've just moved it as per namespace changes.

  • mohit_aghera committed b5dd308 on 8.x-1.x 
    Issue #3110467 by mohit_aghera, johne: missing and broken access check...
mohit_aghera’s picture

mohit_aghera CreditAttribution: mohit_aghera as a volunteer and at Axelerant commented
Status: Needs review » Fixed

Merging it for now.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.