- Issue created by @sgraham42
Adding additional info here as a comment, because it may not be relevant:
the Permissions by Term module seems to use the Grants system for access restrictions. Perhaps this has something to do with it?My current solution is to add a custom patch just for us that adds a Permissions by Term access check to the EntityPrintController.php in checkAccess():
// Ensure access via Permissions By Term if ($entity_type == 'node') { /* @var \Drupal\permissions_by_term\Service\AccessCheck $accessCheck */ $accessCheck = \Drupal::service('permissions_by_term.access_check'); $nodeToCheck = \Drupal\node\Entity\Node::load($entity_id); if (!$accessCheck->canUserAccessByNode($nodeToCheck)) { return AccessResult::forbidden(); } }
This, of course, is not a solution for the module itself, but I include it here because maybe it helps to find a real solution?
- π¦πΊAustralia larowlan π¦πΊπ.au GMT+10
I'll open an issue on security.drupal.org using the report security issue on the project page and unpublish this