Only alter AccessResult if both revision & token are present.

quantcdn · Nov 1, 2023 · cccba88 · cccba88
1 parent 912ae09
commit cccba88
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/quant.module b/quant.module
@@ -172,7 +172,8 @@ function quant_shutdown(array $context = []) {
 function quant_node_access(NodeInterface $node, $op, AccountInterface $account) {
   $request = \Drupal::request();
 
-  if (!$request->headers->has('quant-revision') && !$request->headers->has('quant-token')) {
+  // Both revision & token headers need to be present to alter access.
+  if (!$request->headers->has('quant-revision') || !$request->headers->has('quant-token')) {
     return AccessResult::neutral();
   }