Issue #2095693 by Xano, tim.plunkett: Fixed FilterFormatAccessController...

Issue #2095693 by Xano, tim.plunkett: Fixed FilterFormatAccessController always grants access for any operation on the fallback format.

core/modules/filter/lib/Drupal/filter/FilterFormatAccessController.php

@@ -22,9 +22,14 @@ class FilterFormatAccessController extends EntityAccessController {
   protected function checkAccess(EntityInterface $entity, $operation, $langcode, AccountInterface $account) {
     // Handle special cases up front. All users have access to the fallback
     // format.
-    if ($entity->isFallbackFormat()) {
+    if ($operation == 'view' && $entity->isFallbackFormat()) {
       return TRUE;
     }
+    // We do not allow filter formats to be deleted through the UI, because that
+    // would render any content that uses them unusable.
+    if ($operation == 'delete') {
+      return FALSE;
+    }
 
     if ($operation != 'view' && $account->hasPermission('administer filters')) {
       return TRUE;

core/modules/filter/lib/Drupal/filter/FilterFormatListController.php

@@ -135,8 +135,6 @@ public function getOperations(EntityInterface $entity) {
       unset($operations['disable']);
     }
 
-    // Formats can never be deleted.
-    unset($operations['delete']);
     return $operations;
   }