Issue #2073531 by tim.plunkett, dawehner, Berdir, catch, plach: Use current user service instead of _account, remove _account from the request object.

core/core.services.yml

@@ -407,7 +407,7 @@ services:
     class: Drupal\Core\Access\CsrfTokenGenerator
     arguments: ['@private_key']
     calls:
-      - [setRequest, ['@?request']]
+      - [setCurrentUser, ['@?current_user']]
   access_manager:
     class: Drupal\Core\Access\AccessManager
     arguments: ['@router.route_provider', '@url_generator', '@paramconverter_manager']

core/lib/Drupal/Core/Access/CsrfTokenGenerator.php

@@ -9,7 +9,7 @@ namespace Drupal\Core\Access;
 
 use Drupal\Component\Utility\Crypt;
 use Drupal\Core\PrivateKey;
-use Symfony\Component\HttpFoundation\Request;
+use Drupal\Core\Session\AccountInterface;
 
 /**
  * Generates and validates CSRF tokens.
@@ -26,11 +26,11 @@ class CsrfTokenGenerator {
   protected $privateKey;
 
   /**
-   * The current request object.
+   * The current user.
    *
-   * @var \Symfony\Component\HttpFoundation\Request
+   * @var \Drupal\Core\Session\AccountInterface
    */
-  protected $request;
+  protected $currentUser;
 
   /**
    * Constructs the token generator.
@@ -43,13 +43,13 @@ class CsrfTokenGenerator {
   }
 
   /**
-   * Sets the $request property.
+   * Sets the current user.
    *
-   * @param \Symfony\Component\HttpFoundation\Request $request
+   * @param \Drupal\Core\Session\AccountInterface|null $current_user
-   *   The HttpRequest object representing the current request.
+   *  The current user service.
    */
-  public function setRequest(Request $request) {
+  public function setCurrentUser(AccountInterface $current_user = NULL) {
-    $this->request = $request;
+    $this->currentUser = $current_user;
   }
 
   /**
@@ -84,9 +84,7 @@ class CsrfTokenGenerator {
    *   is TRUE, the return value will always be TRUE for anonymous users.
    */
   public function validate($token, $value = '', $skip_anonymous = FALSE) {
-    $user = $this->request->attributes->get('_account');
+    return ($skip_anonymous && $this->currentUser->isAnonymous()) || ($token == $this->get($value));
-
-    return ($skip_anonymous && $user->isAnonymous()) || ($token == $this->get($value));
   }
 
 }

core/lib/Drupal/Core/Authentication/AuthenticationManager.php

@@ -110,7 +110,6 @@ class AuthenticationManager implements AuthenticationProviderInterface, Authenti
 
     // Save the authenticated account and the provider that supplied it
     //  for later access.
-    $request->attributes->set('_account', $account);
     $request->attributes->set('_authentication_provider', $this->triggeredProviderId);
 
     // The global $user object is included for backward compatibility only and

core/lib/Drupal/Core/EventSubscriber/SpecialAttributesRouteSubscriber.php

@@ -23,7 +23,6 @@ class SpecialAttributesRouteSubscriber extends RouteSubscriberBase {
    */
   protected function alterRoutes(RouteCollection $collection, $module) {
     $special_variables = array(
-      '_account',
       'system_path',
       '_maintenance',
       '_legacy',

core/lib/Drupal/Core/Form/FormBase.php

@@ -178,7 +178,7 @@ abstract class FormBase extends DependencySerialization implements FormInterface
    *   The current user.
    */
   protected function currentUser() {
-    return $this->getRequest()->attributes->get('_account');
+    return \Drupal::currentUser();
   }
 
   /**

core/lib/Drupal/Core/Routing/Enhancer/AuthenticationEnhancer.php

@@ -55,8 +55,6 @@ class AuthenticationEnhancer extends ContainerAware implements RouteEnhancerInte
         $anonymous_user = drupal_anonymous_user();
 
         $this->container->set('current_user', $anonymous_user, 'request');
-        // @todo Remove this in https://drupal.org/node/2073531
-        $request->attributes->set('_account', $anonymous_user);
 
         // The global $user object is included for backward compatibility only
         // and should be considered deprecated.

core/modules/comment/comment.module

@@ -1175,9 +1175,7 @@ function comment_load($cid, $reset = FALSE) {
  *   The number of new comments or FALSE if the user is not logged in.
  */
 function comment_num_new($entity_id, $entity_type, $field_name = NULL, $timestamp = 0) {
-  global $user;
+  if (\Drupal::currentUser()->isAuthenticated() && \Drupal::moduleHandler()->moduleExists('history')) {
-
-  if ($user->isAuthenticated() && \Drupal::moduleHandler()->moduleExists('history')) {
     // Retrieve the timestamp at which the current user last viewed this entity.
     if (!$timestamp) {
       if ($entity_type == 'node') {

core/modules/comment/lib/Drupal/comment/Tests/CommentNodeAccessTest.php

@@ -46,6 +46,9 @@ class CommentNodeAccessTest extends CommentTestBase {
       'node test view',
       'skip comment approval',
     ));
+
+    // Set the author of the created node to the web_user uid.
+    $this->node->setAuthorId($this->web_user->id())->save();
   }
 
   /**

core/modules/comment/lib/Drupal/comment/Tests/CommentTranslationUITest.php

@@ -155,7 +155,7 @@ class CommentTranslationUITest extends ContentTranslationUITest {
    * Tests translate link on comment content admin page.
    */
   function testTranslateLinkCommentAdminPage() {
-    $this->admin_user = $this->drupalCreateUser(array_merge(parent::getTranslatorPermissions(), array('access administration pages', 'administer comments')));
+    $this->admin_user = $this->drupalCreateUser(array_merge(parent::getTranslatorPermissions(), array('access administration pages', 'administer comments', 'skip comment approval')));
     $this->drupalLogin($this->admin_user);
 
     $cid_translatable = $this->createEntity(array(), $this->langcodes[0]);

core/modules/comment/lib/Drupal/comment/Tests/Views/CommentTestBase.php

@@ -36,7 +36,7 @@ abstract class CommentTestBase extends ViewTestBase {
 
     // Add two users, create a node with the user1 as author and another node
     // with user2 as author. For the second node add a comment from user1.
-    $this->account = $this->drupalCreateUser();
+    $this->account = $this->drupalCreateUser(array('skip comment approval'));
     $this->account2 = $this->drupalCreateUser();
     $this->drupalLogin($this->account);
 

core/modules/content_translation/lib/Drupal/content_translation/ContentTranslationController.php

@@ -234,7 +234,14 @@ class ContentTranslationController implements ContentTranslationControllerInterf
         );
       }
 
-      $name = $new_translation ? $GLOBALS['user']->getUsername() : user_load($entity->translation[$form_langcode]['uid'])->getUsername();
+      // Default to the anonymous user.
+      $name = '';
+      if ($new_translation) {
+        $name = $GLOBALS['user']->getUsername();
+      }
+      elseif ($entity->translation[$form_langcode]['uid']) {
+        $name = user_load($entity->translation[$form_langcode]['uid'])->getUsername();
+      }
       $form['content_translation']['name'] = array(
         '#type' => 'textfield',
         '#title' => t('Authored by'),

core/modules/entity_reference/lib/Drupal/entity_reference/Tests/EntityReferenceSelectionAccessTest.php

@@ -119,8 +119,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
 
     // Test as a non-admin.
     $normal_user = $this->drupalCreateUser(array('access content'));
-    $request = $this->container->get('request');
+    $this->container->set('current_user', $normal_user);
-    $request->attributes->set('_account', $normal_user);
     $referenceable_tests = array(
       array(
         'arguments' => array(
@@ -172,7 +171,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
 
     // Test as an admin.
     $admin_user = $this->drupalCreateUser(array('access content', 'bypass node access'));
-    $request->attributes->set('_account', $admin_user);
+    $this->container->set('current_user', $admin_user);
     $referenceable_tests = array(
       array(
         'arguments' => array(
@@ -266,8 +265,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
     }
 
     // Test as a non-admin.
-    $request = $this->container->get('request');
+    $this->container->set('current_user', $users['non_admin']);
-    $request->attributes->set('_account', $users['non_admin']);
     $referenceable_tests = array(
       array(
         'arguments' => array(
@@ -306,7 +304,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
     );
     $this->assertReferenceable($instance, $referenceable_tests, 'User handler');
 
-    $request->attributes->set('_account', $users['admin']);
+    $this->container->set('current_user', $users['admin']);
     $referenceable_tests = array(
       array(
         'arguments' => array(
@@ -448,8 +446,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
 
     // Test as a non-admin.
     $normal_user = $this->drupalCreateUser(array('access content', 'access comments'));
-    $request = $this->container->get('request');
+    $this->container->set('current_user', $normal_user);
-    $request->attributes->set('_account', $normal_user);
     $referenceable_tests = array(
       array(
         'arguments' => array(
@@ -488,7 +485,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
 
     // Test as a comment admin.
     $admin_user = $this->drupalCreateUser(array('access content', 'access comments', 'administer comments'));
-    $request->attributes->set('_account', $admin_user);
+    $this->container->set('current_user', $admin_user);
     $referenceable_tests = array(
       array(
         'arguments' => array(
@@ -506,7 +503,7 @@ class EntityReferenceSelectionAccessTest extends WebTestBase {
 
     // Test as a node and comment admin.
     $admin_user = $this->drupalCreateUser(array('access content', 'access comments', 'administer comments', 'bypass node access'));
-    $request->attributes->set('_account', $admin_user);
+    $this->container->set('current_user', $admin_user);
     $referenceable_tests = array(
       array(
         'arguments' => array(

core/modules/filter/filter.module

@@ -303,9 +303,8 @@ function filter_get_formats_by_role($rid) {
  * @see filter_fallback_format()
  */
 function filter_default_format(AccountInterface $account = NULL) {
-  global $user;
   if (!isset($account)) {
-    $account = $user;
+    $account = \Drupal::currentUser();
   }
   // Get a list of formats for this user, ordered by weight. The first one
   // available is the user's default format.

core/modules/forum/lib/Drupal/forum/Tests/Views/ForumIntegrationTest.php

@@ -62,6 +62,9 @@ class ForumIntegrationTest extends ViewTestBase {
       $nodes[] = $node;
     }
 
+    $account = $this->drupalCreateUser(array('skip comment approval'));
+    $this->drupalLogin($account);
+
     $comments = array();
     foreach ($nodes as $index => $node) {
       for ($i = 0; $i <= $index; $i++) {

core/modules/node/lib/Drupal/node/Tests/NodeAccessPagerTest.php

@@ -55,6 +55,7 @@ class NodeAccessPagerTest extends WebTestBase {
         'comment_body' => array(
           array('value' => $this->randomName()),
         ),
+        'status' => COMMENT_PUBLISHED,
       ));
       $comment->save();
     }

core/modules/node/node.module

@@ -1735,11 +1735,9 @@ function node_access_view_all_nodes($account = NULL) {
  * @endcode
  */
 function node_query_node_access_alter(AlterableInterface $query) {
-  global $user;
-
   // Read meta-data from query, if provided.
   if (!$account = $query->getMetaData('account')) {
-    $account = $user;
+    $account = \Drupal::currentUser();
   }
   if (!$op = $query->getMetaData('op')) {
     $op = 'view';

core/modules/search/lib/Drupal/search/Plugin/SearchInterface.php

@@ -23,9 +23,7 @@ interface SearchInterface extends PluginInspectionInterface {
    *   Array of parameters as am associative array. This is expected to
    *   be the query string from the current request.
    * @param array $attributes
-   *   Array of attributes, usually from the current request object. The search
+   *   Array of attributes, usually from the current request object.
-   *   plugin may use the '_account' attribute if present to personalize the
-   *   search, or use attributes from the current route variables.
    *
    * @return \Drupal\search\Plugin\SearchInterface
    *   A search plugin object for chaining.

core/modules/search/lib/Drupal/search/Tests/SearchCommentCountToggleTest.php

@@ -46,6 +46,9 @@ class SearchCommentCountToggleTest extends SearchTestBase {
     // Create searching user.
     $this->searching_user = $this->drupalCreateUser(array('search content', 'access content', 'access comments', 'skip comment approval'));
 
+    // Login with sufficient privileges.
+    $this->drupalLogin($this->searching_user);
+
     // Add a comment field.
     $this->container->get('comment.manager')->addDefaultField('node', 'article');
     // Create initial nodes.
@@ -54,9 +57,6 @@ class SearchCommentCountToggleTest extends SearchTestBase {
     $this->searchable_nodes['1 comment'] = $this->drupalCreateNode($node_params);
     $this->searchable_nodes['0 comments'] = $this->drupalCreateNode($node_params);
 
-    // Login with sufficient privileges.
-    $this->drupalLogin($this->searching_user);
-
     // Create a comment array
     $edit_comment = array();
     $edit_comment['subject'] = $this->randomName();

core/modules/simpletest/lib/Drupal/simpletest/TestBase.php

@@ -1041,7 +1041,7 @@ abstract class TestBase {
     // different object, so we need to replace the instance on this test class.
     $this->container = \Drupal::getContainer();
     // The global $user is set in TestBase::prepareEnvironment().
-    $this->container->get('request')->attributes->set('_account', $GLOBALS['user']);
+    $this->container->set('current_user', $GLOBALS['user']);
   }
 
   /**

core/modules/simpletest/lib/Drupal/simpletest/WebTestBase.php

@@ -277,7 +277,7 @@ abstract class WebTestBase extends TestBase {
         $settings['uid'] = $this->loggedInUser->id();
       }
       else {
-        global $user;
+        $user = \Drupal::currentUser() ?: $GLOBALS['user'];
         $settings['uid'] = $user->id();
       }
     }

core/modules/system/tests/modules/router_test_directory/lib/Drupal/router_test/TestContent.php

@@ -55,7 +55,7 @@ class TestContent extends ContainerAware implements ContainerInjectionInterface
    *   The user name of the current logged in user.
    */
   public function test11() {
-    $account  = \Drupal::request()->attributes->get('_account');
+    $account = \Drupal::currentUser();
     return $account->getUsername();
   }
 

core/modules/user/lib/Drupal/user/Plugin/Search/UserSearch.php

@@ -51,11 +51,11 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
   protected $moduleHandler;
 
   /**
-   * The current request.
+   * The current user.
    *
-   * @var \Symfony\Component\HttpFoundation\Request
+   * @var \Drupal\Core\Session\AccountInterface
    */
-  protected $request;
+  protected $currentUser;
 
   /**
    * {@inheritdoc}
@@ -65,7 +65,7 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
       $container->get('database'),
       $container->get('plugin.manager.entity'),
       $container->get('module_handler'),
-      $container->get('request'),
+      $container->get('current_user'),
       $configuration,
       $plugin_id,
       $plugin_definition
@@ -81,8 +81,8 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
    *   The entity manager.
    * @param ModuleHandlerInterface $module_handler
    *   The module handler.
-   * @param \Symfony\Component\HttpFoundation\Request $request
+   * @param \Drupal\Core\Session\AccountInterface $current_user
-   *   The current request.
+   *   The current user.
    * @param array $configuration
    *   A configuration array containing information about the plugin instance.
    * @param string $plugin_id
@@ -90,11 +90,11 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
    * @param array $plugin_definition
    *   The plugin implementation definition.
    */
-  public function __construct(Connection $database, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler, Request $request, array $configuration, $plugin_id, array $plugin_definition) {
+  public function __construct(Connection $database, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler, AccountInterface $current_user, array $configuration, $plugin_id, array $plugin_definition) {
     $this->database = $database;
     $this->entityManager = $entity_manager;
     $this->moduleHandler = $module_handler;
-    $this->request = $request;
+    $this->currentUser = $current_user;
     parent::__construct($configuration, $plugin_id, $plugin_definition);
   }
 
@@ -120,8 +120,7 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
       ->select('users')
       ->extend('Drupal\Core\Database\Query\PagerSelectExtender');
     $query->fields('users', array('uid'));
-    $user_account = $this->request->attributes->get('_account');
+    if ($this->currentUser->hasPermission('administer users')) {
-    if ($user_account->hasPermission('administer users')) {
       // Administrators can also search in the otherwise private email field, and
       // they don't need to be restricted to only active users.
       $query->fields('users', array('mail'));
@@ -147,7 +146,7 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
         'title' => $account->getUsername(),
         'link' => url('user/' . $account->id(), array('absolute' => TRUE)),
       );
-      if ($user_account->hasPermission('administer users')) {
+      if ($this->currentUser->hasPermission('administer users')) {
         $result['title'] .= ' (' . $account->getEmail() . ')';
       }
       $results[] = $result;

core/modules/user/lib/Drupal/user/Tests/Views/HandlerFieldUserNameTest.php

@@ -30,6 +30,8 @@ class HandlerFieldUserNameTest extends UserTestBase {
   }
 
   public function testUserName() {
+    $this->drupalLogin($this->drupalCreateUser(array('access user profiles')));
+
     $view = views_get_view('test_views_handler_field_user_name');
     $this->executeView($view);
 

core/modules/user/user.module

@@ -452,7 +452,7 @@ function user_access($string, AccountInterface $account = NULL) {
   if (!isset($account)) {
     // In the installer request session is not set, so we have to fall back
     // to the global $user. In all other cases the session key is preferred.
-    $account = \Drupal::request()->attributes->get('_account') ?: $user;
+    $account = \Drupal::currentUser() ?: $user;
   }
 
   return $account->hasPermission($string);
@@ -1265,7 +1265,7 @@ function user_cancel_methods() {
     'user_cancel_delete' => array(
       'title' => t('Delete the account and its content.'),
       'description' => t('Your account will be removed and all account information deleted. All of your content will also be deleted.'),
-      'access' => \Drupal::request()->attributes->get('_account')->hasPermission('administer users'),
+      'access' => \Drupal::currentUser()->hasPermission('administer users'),
     ),
   );
   // Allow modules to customize account cancellation methods.

core/tests/Drupal/Tests/Core/Access/CsrfTokenGeneratorTest.php

@@ -49,7 +49,6 @@ class CsrfTokenGeneratorTest extends UnitTestCase {
       ->will($this->returnValue($this->key));
 
     $this->generator = new CsrfTokenGenerator($private_key);
-    $this->generator->setRequest(new Request());
   }
 
   /**
@@ -79,18 +78,14 @@ class CsrfTokenGeneratorTest extends UnitTestCase {
     $account->expects($this->once())
       ->method('isAnonymous')
       ->will($this->returnValue(TRUE));
-    $request = new Request();
+    $this->generator->setCurrentUser($account);
-    $request->attributes->set('_account', $account);
-    $this->generator->setRequest($request);
     $this->assertTrue($this->generator->validate($token, 'foo', TRUE));
 
     $account = $this->getMock('Drupal\Core\Session\AccountInterface');
     $account->expects($this->once())
       ->method('isAnonymous')
       ->will($this->returnValue(FALSE));
-    $request = new Request();
+    $this->generator->setCurrentUser($account);
-    $request->attributes->set('_account', $account);
-    $this->generator->setRequest($request);
 
     $this->assertFalse($this->generator->validate($token, 'foo', TRUE));
   }

core/tests/Drupal/Tests/Core/EventSubscriber/SpecialAttributesRouteSubscriberTest.php

@@ -53,7 +53,6 @@ class SpecialAttributesRouteSubscriberTest extends UnitTestCase {
    */
   public function providerTestOnRouteBuildingInvalidVariables() {
     $routes = array();
-    $routes[] = array(new Route('/test/{_account}'));
     $routes[] = array(new Route('/test/{system_path}'));
     $routes[] = array(new Route('/test/{_maintenance}'));
     $routes[] = array(new Route('/test/{_legacy}'));