Currently if a form element contains an invalid #access value, it will be silently evaluated to a boolean.
This could make some security bugs hard to detect.
Add something like this to a form element:
'#access' => new \stdClass(),
The form element is displayed and processed.
We could log a warning if the value is not a boolean or an AccessResultInterface object.
Active
11.0 🔥
forms system
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
I think an exception throw is the best way to notify the developer..
I think an exception throw is the best way to notify the developer..
I agree but I wonder if it could be a breaking change if some custom code relies on passing something that is currently evaluated to true?