- Issue created by @Anybody
Just found this TODO in 5.x:
/**
* {@inheritdoc}
*/
/*public function processRoute(Route $route) {
// @todo Check perms of taxonomy vocabulary access.
//$route->setRequirement('_entity_access', $this->getDerivativeId() .'.view');
}*/
in class VocabularyTreeGet
(https://git.drupalcode.org/project/services/-/blob/5.x/src/Plugin/Servic...)
Leaving this issue as reminder to implement it for security.
Active
5.0
Code