CVE-2018-10919 security: Move object-specific access checks into separate function