diff core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php @ 17:129ea1e6d783

Update, including to Drupal core 8.6.10

--- a/core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php	Tue Jul 10 15:07:59 2018 +0100
+++ b/core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php	Thu Feb 28 13:21:36 2019 +0000
@@ -89,12 +89,15 @@
   public function access(Request $request, AccountInterface $account) {
     $method = $request->getMethod();
 
+    // Read-only operations are always allowed.
+    if (in_array($method, ['GET', 'HEAD', 'OPTIONS', 'TRACE'], TRUE)) {
+      return AccessResult::allowed();
+    }
+
     // This check only applies if
-    // 1. this is a write operation
-    // 2. the user was successfully authenticated and
-    // 3. the request comes with a session cookie.
-    if (!in_array($method, ['GET', 'HEAD', 'OPTIONS', 'TRACE'])
-      && $account->isAuthenticated()
+    // 1. the user was successfully authenticated and
+    // 2. the request comes with a session cookie.
+    if ($account->isAuthenticated()
       && $this->sessionConfiguration->hasSession($request)
     ) {
       if (!$request->headers->has('X-CSRF-Token')) {