diff --git a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceEntityFormatter.php b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceEntityFormatter.php index dd054f2..190cd43 100644 --- a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceEntityFormatter.php +++ b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceEntityFormatter.php @@ -80,9 +80,6 @@ public function settingsSummary() { * {@inheritdoc} */ public function viewElements(EntityInterface $entity, $langcode, FieldInterface $items) { - // Remove un-accessible items. - parent::viewElements($entity, $langcode, $items); - $view_mode = $this->getSetting('view_mode'); $links = $this->getSetting('links'); @@ -91,6 +88,10 @@ public function viewElements(EntityInterface $entity, $langcode, FieldInterface $elements = array(); foreach ($items as $delta => $item) { + if (!$item->access) { + // User doesn't have access to the referenced entity. + continue; + } // Protect ourselves from recursive rendering. static $depth = 0; $depth++; diff --git a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceFormatterBase.php b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceFormatterBase.php index 98db38e..1d62824 100644 --- a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceFormatterBase.php +++ b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceFormatterBase.php @@ -94,19 +94,4 @@ public function prepareView(array $entities, $langcode, array $items) { } } } - - /** - * Overrides \Drupal\field\Plugin\Type\Formatter\FormatterBase::viewElements(). - * - * @see \Drupal\entity_reference\Plugin\field\formatter\EntityReferenceFormatterBase::viewElements(). - */ - public function viewElements(EntityInterface $entity, $langcode, FieldInterface $items) { - // Remove un-accessible items. - foreach ($items as $delta => $item) { - if (empty($item->access)) { - unset($items[$delta]); - } - } - return array(); - } } diff --git a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceIdFormatter.php b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceIdFormatter.php index f7402bf..f8c1196 100644 --- a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceIdFormatter.php +++ b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceIdFormatter.php @@ -34,6 +34,10 @@ public function viewElements(EntityInterface $entity, $langcode, FieldInterface $elements = array(); foreach ($items as $delta => $item) { + if (!$item->access) { + // User doesn't have access to the referenced entity. + continue; + } if (!empty($item->entity) && !empty($item->target_id)) { $elements[$delta] = array('#markup' => check_plain($item->target_id)); } diff --git a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceLabelFormatter.php b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceLabelFormatter.php index c63dfd6..31397f6 100644 --- a/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceLabelFormatter.php +++ b/core/modules/entity_reference/lib/Drupal/entity_reference/Plugin/field/formatter/EntityReferenceLabelFormatter.php @@ -56,17 +56,18 @@ public function settingsSummary() { * {@inheritdoc} */ public function viewElements(EntityInterface $entity, $langcode, FieldInterface $items) { - // Remove un-accessible items. - parent::viewElements($entity, $langcode, $items); - $elements = array(); foreach ($items as $delta => $item) { - if ($entity = $item->entity) { - $label = $entity->label(); + if (!$item->access) { + // User doesn't have access to the referenced entity. + continue; + } + if ($referenced_entity = $item->entity) { + $label = $referenced_entity->label(); // If the link is to be displayed and the entity has a uri, // display a link. - if ($this->getSetting('link') && $uri = $entity->uri()) { + if ($this->getSetting('link') && $uri = $referenced_entity->uri()) { $elements[$delta] = array( '#type' => 'link', '#title' => $label, diff --git a/core/modules/entity_reference/lib/Drupal/entity_reference/Tests/EntityReferenceFormatterTest.php b/core/modules/entity_reference/lib/Drupal/entity_reference/Tests/EntityReferenceFormatterTest.php new file mode 100644 index 0000000..1ba23f0 --- /dev/null +++ b/core/modules/entity_reference/lib/Drupal/entity_reference/Tests/EntityReferenceFormatterTest.php @@ -0,0 +1,95 @@ + 'Entity reference formatters', + 'description' => 'Tests the formatters functionality.', + 'group' => 'Entity Reference', + ); + } + + public function setUp() { + parent::setUp(); + + entity_reference_create_instance($this->entityType, $this->bundle, $this->fieldName, 'Field test', $this->entityType); + } + + /** + * Assert unaccessible items don't change the data of the fields. + */ + public function testAccess() { + $field_name = $this->fieldName; + + $entity_1 = entity_create($this->entityType, array('name' => $this->randomName())); + $entity_1->save(); + + $entity_2 = entity_create($this->entityType, array('name' => $this->randomName())); + $entity_2->save(); + $entity_2->{$field_name}->entity = $entity_1; + + // Assert user doesn't have access to the entity. + $this->assertFalse($entity_1->access('view'), 'Current user does not have access to view the referenced entity.'); + + $formatter_manager = \Drupal::service('plugin.manager.field.formatter'); + + // Get all the existing formatters. + foreach ($formatter_manager->getOptions('entity_reference') as $formatter => $name) { + // Set formatter type for the 'full' view mode. + entity_get_display($this->entityType, $this->bundle, 'default') + ->setComponent($field_name, array( + 'type' => $formatter, + )) + ->save(); + + // Invoke entity view. + entity_view($entity_2, 'default'); + + // Verify the un-accessible item still exists. + $this->assertEqual($entity_2->{$field_name}->value, $entity_1->id(), format_string('The un-accessible item still exists after @name formatter was executed.', array('@name' => $name))); + } + } +}