view core/modules/user/src/Entity/UserRouteProvider.php @ 13:5fb285c0d0e3

Update Drupal core to 8.4.7 via Composer. Security update; I *think* we've
been lucky to get away with this so far, as we don't support self-registration
which seems to be used by the so-called "drupalgeddon 2" attack that 8.4.5
was vulnerable to.

<?php

namespace Drupal\user\Entity;

use Drupal\Core\Entity\EntityTypeInterface;
use Drupal\Core\Entity\Routing\EntityRouteProviderInterface;
use Symfony\Component\Routing\Route;
use Symfony\Component\Routing\RouteCollection;

/**
 * Provides routes for the user entity.
 */
class UserRouteProvider implements EntityRouteProviderInterface {

  /**
   * {@inheritdoc}
   */
  public function getRoutes(EntityTypeInterface $entity_type) {
    $route_collection = new RouteCollection();
    $route = (new Route('/user/{user}'))
      ->setDefaults([
        '_entity_view' => 'user.full',
        '_title_callback' => 'Drupal\user\Controller\UserController::userTitle',
      ])
      ->setRequirement('user', '\d+')
      ->setRequirement('_entity_access', 'user.view');
    $route_collection->add('entity.user.canonical', $route);

    $route = (new Route('/user/{user}/edit'))
      ->setDefaults([
        '_entity_form' => 'user.default',
        '_title_callback' => 'Drupal\user\Controller\UserController::userTitle',
      ])
      ->setOption('_admin_route', TRUE)
      ->setRequirement('user', '\d+')
      ->setRequirement('_entity_access', 'user.update');
    $route_collection->add('entity.user.edit_form', $route);

    $route = (new Route('/user/{user}/cancel'))
      ->setDefaults([
        '_title' => 'Cancel account',
        '_entity_form' => 'user.cancel',
      ])
      ->setOption('_admin_route', TRUE)
      ->setRequirement('user', '\d+')
      ->setRequirement('_entity_access', 'user.delete');
    $route_collection->add('entity.user.cancel_form', $route);

    return $route_collection;
  }

}