5 use Drupal\Core\Access\AccessResult;
6 use Drupal\Core\Access\AccessResultNeutral;
7 use Drupal\Core\Entity\EntityInterface;
8 use Drupal\Core\Entity\EntityAccessControlHandler;
9 use Drupal\Core\Field\FieldDefinitionInterface;
10 use Drupal\Core\Field\FieldItemListInterface;
11 use Drupal\Core\Session\AccountInterface;
14 * Defines the access control handler for the user entity type.
16 * @see \Drupal\user\Entity\User
18 class UserAccessControlHandler extends EntityAccessControlHandler {
21 * Allow access to user label.
25 protected $viewLabelOperation = TRUE;
30 protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
31 /** @var \Drupal\user\UserInterface $entity*/
33 // We don't treat the user label as privileged information, so this check
34 // has to be the first one in order to allow labels for all users to be
35 // viewed, including the special anonymous user.
36 if ($operation === 'view label') {
37 return AccessResult::allowed();
40 // The anonymous user's profile can neither be viewed, updated nor deleted.
41 if ($entity->isAnonymous()) {
42 return AccessResult::forbidden();
45 // Administrators can view/update/delete all user profiles.
46 if ($account->hasPermission('administer users')) {
47 return AccessResult::allowed()->cachePerPermissions();
52 // Only allow view access if the account is active.
53 if ($account->hasPermission('access user profiles') && $entity->isActive()) {
54 return AccessResult::allowed()->cachePerPermissions()->addCacheableDependency($entity);
56 // Users can view own profiles at all times.
57 elseif ($account->id() == $entity->id()) {
58 return AccessResult::allowed()->cachePerUser();
61 return AccessResultNeutral::neutral("The 'access user profiles' permission is required and the user must be active.");
66 // Users can always edit their own account.
67 return AccessResult::allowedIf($account->id() == $entity->id())->cachePerUser();
70 // Users with 'cancel account' permission can cancel their own account.
71 return AccessResult::allowedIf($account->id() == $entity->id() && $account->hasPermission('cancel account'))->cachePerPermissions()->cachePerUser();
75 return AccessResult::neutral();
81 protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) {
82 // Fields that are not implicitly allowed to administrative users.
83 $explicit_check_fields = [
87 // Administrative users are allowed to edit and view all fields.
88 if (!in_array($field_definition->getName(), $explicit_check_fields) && $account->hasPermission('administer users')) {
89 return AccessResult::allowed()->cachePerPermissions();
92 // Flag to indicate if this user entity is the own user account.
93 $is_own_account = $items ? $items->getEntity()->id() == $account->id() : FALSE;
94 switch ($field_definition->getName()) {
96 // Allow view access to anyone with access to the entity. Anonymous
97 // users should be able to access the username field during the
98 // registration process, otherwise the username and email constraints
100 if ($operation == 'view' || ($items && $account->isAnonymous() && $items->getEntity()->isAnonymous())) {
101 return AccessResult::allowed()->cachePerPermissions();
103 // Allow edit access for the own user name if the permission is
105 if ($is_own_account && $account->hasPermission('change own username')) {
106 return AccessResult::allowed()->cachePerPermissions()->cachePerUser();
109 return AccessResult::forbidden();
112 case 'preferred_langcode':
113 case 'preferred_admin_langcode':
116 // Allow view access to own mail address and other personalization
118 if ($operation == 'view') {
119 return $is_own_account ? AccessResult::allowed()->cachePerUser() : AccessResult::forbidden();
121 // Anyone that can edit the user can also edit this field.
122 return AccessResult::allowed()->cachePerPermissions();
125 // Allow editing the password, but not viewing it.
126 return ($operation == 'edit') ? AccessResult::allowed() : AccessResult::forbidden();
129 // Allow viewing the created date, but not editing it.
130 return ($operation == 'view') ? AccessResult::allowed() : AccessResult::forbidden();
137 return AccessResult::forbidden();
140 return parent::checkFieldAccess($operation, $field_definition, $account, $items);