2

I have created user login link in the user account menu but the link is visible all the time(even for logged users). The user profile menu link and the user logout links are displayed properly(they are added by the user module).

My link definition doesn't differ from the user's module link definitions in any way but still this happens. Also the user.login route has proper requirements so this should just not happen but it does.

This is how user module defines menu links:

user.page:
  title: 'My account'
  weight: -10
  route_name: user.page
  menu_name: account
user.logout:
  title: 'Log out'
  route_name: user.logout
  weight: 10
  menu_name: account

This is how I define my login link:

user.login:
  title: 'Log in'
  weight: -10
  route_name: user.login
  menu_name: account
1
  • The same goes for user/register.
    – user21641
    Apr 26 '15 at 5:33
2

This seems to be a bug, /user/login should not be accessible as an authenticated user, but it redirects to user/1.

Edit: Discussed this with @dawehner and we figured it out together. This is egression: Do not bypass route access with 'link to any page' permissions for menu links

Open a bug report. This might actually a be a pretty serious security issue, looking at AccessManager, I don't understand why that starts with an allowed() state,LoginStatusCheck returns neutral, that is merged together to an allowed().

This site is temporarily in read only mode and not accepting new answers.