BlockContent JSON:API collection endpoint doesn't return unpublished block when filtered without administer block content permission

Confirmed this fixes testCollection failures in 🐛 Information disclosure access bypass for revision log fields when the JSON:API module is enabled Fixed , I'm guessing we'll need additional tests though?

If we remove 'administer block content' from the list in the test and this still passes that would pass as test coverage right?

Yes, great point! So just porting the test's permissions changes from 3395404 into here.

Only rebased to run test-only feature

1) Drupal\Tests\jsonapi\Functional\BlockContentTest::testCollection
The 'data' member was not as expected.
Failed asserting that two arrays are equal.
--- Expected
+++ Actual
@@ @@
 Array (
-    0 => Array (...)
 )
/build

Know doesn't fully help without the comparison but test did correctly fail.

@smustgrave thank you! And yes, the failure message is shocking for those tests 😅. Have a look at 📌 Tests extending jsonapi's ResourceTestBase are extremely hard to debug/maintain/deal with Active for my frustrations

Backported to 10.1.x as a bug fix to assist with a future security improvement.

Committed and pushed 257191b8a2 to 11.x and 30ac531e74 to 10.2.x and 0edb2442ad to 10.1.x. Thanks!

Automatically closed - issue fixed for 2 weeks with no activity.

acbramley → closed merge request !5059