Contrib.social

Access check in AnnounceBlock does not take into account $return_as_object parameter

Open on Drupal.org →
Created on 15 January 2024, about 1 year ago
Updated 7 February 2024, 12 months ago

Problem/Motivation

As part of 📌 Convert announcements feed from toolbar to dashboard Postponed a new block was created to show the announcements feed as a block.

This block checks if the user has 'access announcements' to grant access or not to the block. This logic has a bug.

According to BlockPluginTrait documentation, it encourages the use of blockAccess() method instead of access() to "to avoid repeating the handling of the $return_as_object argument."

AnnounceBlock overrides access() method instead of blockAccess(), and it does not handle the $return_as_object argument, so it could break method implementations that expect to get a boolean instead of an AccessResultInterface.

Steps to reproduce

Run this in your php console (drush php):

  • $manager = \Drupal::service('plugin.manager.block')
  • $user = new \Drupal\Core\Session\AnonymousUserSession()
  • $block = $manager->createInstance('announce_block')
  • $block->access($user)

It returns an instance of Drupal\Core\Access\AccessResultNeutral instead of FALSE.

Proposed resolution

Implement the access logic in blockAccess() method instead of access().

Remaining tasks

Implement fix
Add test coverage

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet

None

🐛 Bug report
Status

Fixed

Version

10.2 ✨

Component
Announcements feed  →

Last updated 11 months ago

No maintainer
Created by

🇪🇸Spain plopesc Valladolid

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024