Like blocks have blockAccess, we should also have portletAccess() on all portlet types to determine if the user has permission to access the portlet.
The access should also be checked in portlet add to only present the portlet for adding, if the user is allowed to use it.
Blocks define it in the BlockPluginTrait:
/**
* {@inheritdoc}
*/
public function access(AccountInterface $account, $return_as_object = FALSE) {
$access = $this->blockAccess($account);
return $return_as_object ? $access : $access->isAllowed();
}
/**
* Indicates whether the block should be shown.
*
* Blocks with specific access checking should override this method rather
* than access(), in order to avoid repeating the handling of the
* $return_as_object argument.
*
* @param \Drupal\Core\Session\AccountInterface $account
* The user session for which to check access.
*
* @return \Drupal\Core\Access\AccessResultInterface
* The access result.
*
* @see self::access()
*/
protected function blockAccess(AccountInterface $account) {
// By default, the block is visible.
return AccessResult::allowed();
}
Fixed
3.0
Code
Automatically closed - issue fixed for 2 weeks with no activity.