Contrib.social

PrivateMessageThreadMemberFormatter links to users even without access

Open on Drupal.org →
Created on 12 January 2023, over 1 year ago
Updated 28 January 2023, over 1 year ago

Problem/Motivation

When generating the link to a thread member, the URL generated for the canonical user route is not checked for access. This leads to dead links to user profiles that cannot be accessed.

Steps to reproduce

Start message thread to another user. Mark the other user account as blocked. Refresh the thread and click the link to the other user's profile.

Proposed resolution

Attached is a patch that calls ->access() on the generated URL before using that.

🐛 Bug report
Status

Fixed

Version

3.0

Component

Code

Created by

🇳🇱Netherlands dennis_meuwissen

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024