diff --git a/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php b/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php index 6ecfa75..7901925 100644 --- a/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php +++ b/modules/entity_form/src/Plugin/EntityBrowser/Widget/EntityForm.php @@ -239,4 +239,13 @@ class EntityForm extends WidgetBase { $this->configuration['form_mode'] = $this->configuration['form_mode']['form_select']; } + /** + * {@inheritdoc} + */ + public function access() { + return $this->entityTypeManager + ->getAccessControlHandler($this->configuration['entity_type']) + ->createAccess($this->configuration['bundle'], NULL, [], TRUE); + } + } diff --git a/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php b/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php index aef8ebb..7591391 100644 --- a/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php +++ b/modules/entity_form/tests/src/FunctionalJavascript/EntityFormWidgetTest.php @@ -75,6 +75,7 @@ class EntityFormWidgetTest extends JavascriptTestBase { $account = $this->drupalCreateUser([ 'access entity_browser_test_entity_form entity browser pages', 'create foo content', + 'create article content', 'access content', ]); $this->drupalLogin($account); @@ -148,6 +149,16 @@ class EntityFormWidgetTest extends JavascriptTestBase { $parent_node = current($parent_node); $this->assertEquals(1, $parent_node->get('field_reference')->count(), 'There is one child node.'); $this->assertEquals('War is peace', $parent_node->field_reference->entity->label(), 'Child node has correct title.'); + + // Make sure entity create access is respected. + $account = $this->drupalCreateUser([ + 'access entity_browser_test_entity_form entity browser pages', + 'create foo content', + 'access content', + ]); + $this->drupalLogin($account); + $this->drupalGet('entity-browser/iframe/entity_browser_test_entity_form'); + $this->assertSession()->pageTextContains('No widgets are available.'); } } diff --git a/src/Entity/EntityBrowser.php b/src/Entity/EntityBrowser.php index 53bc9f2..be75e6c 100644 --- a/src/Entity/EntityBrowser.php +++ b/src/Entity/EntityBrowser.php @@ -303,6 +303,14 @@ class EntityBrowser extends ConfigEntityBase implements EntityBrowserInterface, */ public function getFirstWidget() { $instance_ids = $this->getWidgets()->getInstanceIds(); + $instance_ids = array_filter($instance_ids, function ($id) { + return $this->getWidget($id)->access()->isAllowed(); + }); + + if (empty($instance_ids)) { + return NULL; + } + return reset($instance_ids); } diff --git a/src/EntityBrowserFormInterface.php b/src/EntityBrowserFormInterface.php index 335fe96..d274b6e 100644 --- a/src/EntityBrowserFormInterface.php +++ b/src/EntityBrowserFormInterface.php @@ -17,4 +17,12 @@ interface EntityBrowserFormInterface extends FormInterface { */ public function setEntityBrowser(EntityBrowserInterface $entity_browser); + /** + * Gets entity browser entity, + * + * @return \Drupal\entity_browser\EntityBrowserInterface + * Entity browser entity. + */ + public function getEntityBrowser(); + } diff --git a/src/EntityBrowserInterface.php b/src/EntityBrowserInterface.php index cfad325..09a5e86 100644 --- a/src/EntityBrowserInterface.php +++ b/src/EntityBrowserInterface.php @@ -123,8 +123,8 @@ interface EntityBrowserInterface extends ConfigEntityInterface { /** * Gets first widget based on weights. * - * @return string - * First widget instance ID. + * @return string|null + * First widget instance ID or NULL if no widgets are available. */ public function getFirstWidget(); diff --git a/src/Form/EntityBrowserForm.php b/src/Form/EntityBrowserForm.php index 340e425..bcecac1 100644 --- a/src/Form/EntityBrowserForm.php +++ b/src/Form/EntityBrowserForm.php @@ -11,6 +11,7 @@ use Drupal\entity_browser\DisplayAjaxInterface; use Drupal\entity_browser\EntityBrowserFormInterface; use Drupal\entity_browser\EntityBrowserInterface; use Symfony\Component\DependencyInjection\ContainerInterface; +use Drupal\Core\Render\RendererInterface; /** * The entity browser form. @@ -38,6 +39,13 @@ class EntityBrowserForm extends FormBase implements EntityBrowserFormInterface { */ protected $selectionStorage; + /** + * The renderer service. + * + * @var \Drupal\Core\Render\RendererInterface + */ + protected $renderer; + /** * Constructs a EntityBrowserForm object. * @@ -45,10 +53,13 @@ class EntityBrowserForm extends FormBase implements EntityBrowserFormInterface { * The UUID generator service. * @param \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface $selection_storage * Selection storage. + * @param \Drupal\Core\Render\RendererInterface $renderer + * The renderer service. */ - public function __construct(UuidInterface $uuid_generator, KeyValueStoreExpirableInterface $selection_storage) { + public function __construct(UuidInterface $uuid_generator, KeyValueStoreExpirableInterface $selection_storage, RendererInterface $renderer) { $this->uuidGenerator = $uuid_generator; $this->selectionStorage = $selection_storage; + $this->renderer = $renderer; } /** @@ -57,7 +68,8 @@ class EntityBrowserForm extends FormBase implements EntityBrowserFormInterface { public static function create(ContainerInterface $container) { return new static( $container->get('uuid'), - $container->get('entity_browser.selection_storage') + $container->get('entity_browser.selection_storage'), + $container->get('renderer') ); } @@ -75,6 +87,13 @@ class EntityBrowserForm extends FormBase implements EntityBrowserFormInterface { $this->entityBrowser = $entity_browser; } + /** + * {@inheritdoc} + */ + public function getEntityBrowser() { + return $this->entityBrowser; + } + /** * Initializes form state. * @@ -124,16 +143,33 @@ class EntityBrowserForm extends FormBase implements EntityBrowserFormInterface { 'widget' => 'widget', 'selection_display' => 'selection_display', ]; + + if (!($current_widget_id = $this->getCurrentWidget($form_state))) { + drupal_set_message($this->t('No widgets are available.'), 'warning'); + return $form; + } + $this->entityBrowser ->getWidgetSelector() - ->setDefaultWidget($this->getCurrentWidget($form_state)); + ->setDefaultWidget($current_widget_id); $form[$form['#browser_parts']['widget_selector']] = $this->entityBrowser ->getWidgetSelector() ->getForm($form, $form_state); - $form[$form['#browser_parts']['widget']] = $this->entityBrowser - ->getWidgets() - ->get($this->getCurrentWidget($form_state)) - ->getForm($form, $form_state, $this->entityBrowser->getAdditionalWidgetParameters()); + + $widget = $this->entityBrowser->getWidget($current_widget_id); + if ($widget->access()->isAllowed()) { + $form[$form['#browser_parts']['widget']] = $widget->getForm($form, $form_state, $this->entityBrowser->getAdditionalWidgetParameters()); + } + else { + drupal_set_message($this->t('Access to the widget forbidden.'), 'warning'); + } + + // Add cache access cache metadata from the widgets to the form directly as + // it is affected. + foreach ($this->entityBrowser->getWidgets() as $widget) { + /** @var \Drupal\entity_browser\WidgetInterface $widget */ + $this->renderer->addCacheableDependency($form, $widget->access()); + } $form[$form['#browser_parts']['selection_display']] = $this->entityBrowser ->getSelectionDisplay() diff --git a/src/Plugin/EntityBrowser/Widget/View.php b/src/Plugin/EntityBrowser/Widget/View.php index f0aaa19..8c87862 100644 --- a/src/Plugin/EntityBrowser/Widget/View.php +++ b/src/Plugin/EntityBrowser/Widget/View.php @@ -3,6 +3,7 @@ namespace Drupal\entity_browser\Plugin\EntityBrowser\Widget; use Drupal\Component\Plugin\Exception\PluginNotFoundException; +use Drupal\Core\Access\AccessResult; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\Element; use Drupal\entity_browser\WidgetBase; @@ -279,4 +280,20 @@ class View extends WidgetBase implements ContainerFactoryPluginInterface { return $dependencies; } + /** + * {@inheritdoc} + */ + public function access() { + // Mark the widget as not visible if the user has no access to the view. + /** @var \Drupal\views\ViewExecutable $view */ + $view = $this->entityTypeManager + ->getStorage('view') + ->load($this->configuration['view']) + ->getExecutable(); + + + // Check if the current user has access to this view. + return AccessResult::allowedIf($view->access($this->configuration['view_display'])); + } + } diff --git a/src/Plugin/EntityBrowser/WidgetSelector/DropDown.php b/src/Plugin/EntityBrowser/WidgetSelector/DropDown.php index d5d32d5..ef3315a 100644 --- a/src/Plugin/EntityBrowser/WidgetSelector/DropDown.php +++ b/src/Plugin/EntityBrowser/WidgetSelector/DropDown.php @@ -24,9 +24,19 @@ class DropDown extends WidgetSelectorBase { $form['#prefix'] = '
'; $form['#suffix'] = '
'; + /** @var \Drupal\entity_browser\EntityBrowserInterface $browser */ + $browser = $form_state->getFormObject()->getEntityBrowser(); + + $widget_ids = []; + foreach ($this->widget_ids as $widget_id => $widget_name) { + if ($browser->getWidget($widget_id)->access()->isAllowed()) { + $widget_ids[$widget_id] = $widget_name; + } + } + $element['widget'] = [ '#type' => 'select', - '#options' => $this->widget_ids, + '#options' => $widget_ids, '#default_value' => $this->getDefaultWidget(), '#executes_submit_callback' => TRUE, '#limit_validation_errors' => [['widget']], diff --git a/src/Plugin/EntityBrowser/WidgetSelector/Tabs.php b/src/Plugin/EntityBrowser/WidgetSelector/Tabs.php index e6d511d..0128b29 100644 --- a/src/Plugin/EntityBrowser/WidgetSelector/Tabs.php +++ b/src/Plugin/EntityBrowser/WidgetSelector/Tabs.php @@ -21,6 +21,8 @@ class Tabs extends WidgetSelectorBase { */ public function getForm(array &$form = [], FormStateInterface &$form_state = NULL) { $element = []; + /** @var \Drupal\entity_browser\EntityBrowserInterface $browser */ + $browser = $form_state->getFormObject()->getEntityBrowser(); foreach ($this->widget_ids as $id => $label) { $name = 'tab_selector_' . $id; $element[$name] = [ @@ -34,6 +36,7 @@ class Tabs extends WidgetSelectorBase { '#submit' => [], '#name' => $name, '#widget_id' => $id, + '#access' => $browser->getWidget($id)->access(), ]; } diff --git a/src/WidgetBase.php b/src/WidgetBase.php index da094e4..f5d2ea7 100644 --- a/src/WidgetBase.php +++ b/src/WidgetBase.php @@ -3,6 +3,7 @@ namespace Drupal\entity_browser; use Drupal\Component\Utility\NestedArray; +use Drupal\Core\Access\AccessResult; use Drupal\Core\Entity\EntityTypeManagerInterface; use Drupal\Core\Plugin\PluginBase; use Drupal\Core\Form\FormStateInterface; @@ -372,4 +373,11 @@ abstract class WidgetBase extends PluginBase implements WidgetInterface, Contain } } + /** + * {@inheritdoc} + */ + public function access() { + return AccessResult::allowed(); + } + } diff --git a/src/WidgetInterface.php b/src/WidgetInterface.php index 0a1140f..c88f4b8 100644 --- a/src/WidgetInterface.php +++ b/src/WidgetInterface.php @@ -118,4 +118,12 @@ interface WidgetInterface extends PluginInspectionInterface, ConfigurablePluginI */ public function requiresJsCommands(); + /** + * Defines if the widget is visible / accessible in a given context. + * + * @return \Drupal\Core\Access\AccessResultInterface + * The access result. + */ + public function access(); + } diff --git a/tests/modules/entity_browser_test/config/install/entity_browser.browser.test_entity_browser_file.yml b/tests/modules/entity_browser_test/config/install/entity_browser.browser.test_entity_browser_file.yml index 65178f0..d75ba00 100644 --- a/tests/modules/entity_browser_test/config/install/entity_browser.browser.test_entity_browser_file.yml +++ b/tests/modules/entity_browser_test/config/install/entity_browser.browser.test_entity_browser_file.yml @@ -35,3 +35,10 @@ widgets: weight: -10 label: view id: view + cbc59500-04ab-4395-b063-c561f0e3bf80: + id: dummy + label: dummy + weight: -8 + uuid: cbc59500-04ab-4395-b063-c561f0e3bf80 + settings: + text: 'This is dummy widget.' diff --git a/tests/modules/entity_browser_test/entity_browser_test.services.yml b/tests/modules/entity_browser_test/entity_browser_test.services.yml new file mode 100644 index 0000000..17e1f17 --- /dev/null +++ b/tests/modules/entity_browser_test/entity_browser_test.services.yml @@ -0,0 +1,5 @@ +services: + cache_context.eb_dummy: + class: Drupal\entity_browser_test\Cache\Context\DummyCacheContext + tags: + - { name: cache.context} diff --git a/tests/modules/entity_browser_test/src/Cache/Context/DummyCacheContext.php b/tests/modules/entity_browser_test/src/Cache/Context/DummyCacheContext.php new file mode 100644 index 0000000..ee53905 --- /dev/null +++ b/tests/modules/entity_browser_test/src/Cache/Context/DummyCacheContext.php @@ -0,0 +1,36 @@ +getValue('dummy_entities', []); } + /** + * {@inheritdoc} + */ + public function access() { + if (\Drupal::state()->get('eb_test_dummy_widget_access', TRUE)) { + $access = AccessResult::allowed(); + $access->addCacheContexts(['eb_dummy']); + } + else { + $access = AccessResult::forbidden(); + $access->addCacheContexts(['eb_dummy']); + } + return $access; + } + } diff --git a/tests/src/FunctionalJavascript/EntityBrowserTest.php b/tests/src/FunctionalJavascript/EntityBrowserTest.php index e8add2c..857d2c1 100644 --- a/tests/src/FunctionalJavascript/EntityBrowserTest.php +++ b/tests/src/FunctionalJavascript/EntityBrowserTest.php @@ -78,6 +78,7 @@ class EntityBrowserTest extends EntityBrowserJavascriptTestBase { $this->getSession()->switchToIFrame('entity_browser_iframe_test_entity_browser_file'); + $this->assertSession()->linkExists('dummy'); $this->assertSession()->linkExists('view'); $this->assertSession()->linkExists('upload'); @@ -102,6 +103,26 @@ class EntityBrowserTest extends EntityBrowserJavascriptTestBase { // 'files[upload][]' => $this->container->get('file_system')->realpath($image2->getFileUri()), //]; // $this->drupalPostForm(NULL, $edit, 'Select files');. + + \Drupal::state()->set('eb_test_dummy_widget_access', FALSE); + $this->drupalGet('entity-browser/iframe/test_entity_browser_file'); + $this->assertSession()->linkNotExists('dummy'); + $this->assertSession()->linkExists('view'); + $this->assertSession()->linkExists('upload'); + $this->assertSession()->responseHeaderContains('X-Drupal-Cache-Contexts', 'eb_dummy'); + + // Move dummy widget to the first place and make sure it does not appear. + $browser = $this->container->get('entity_type.manager') + ->getStorage('entity_browser') + ->load('test_entity_browser_file'); + $browser->getWidget('cbc59500-04ab-4395-b063-c561f0e3bf80')->setWeight(-15); + $browser->save(); + $this->drupalGet('entity-browser/iframe/test_entity_browser_file'); + $this->assertSession()->linkNotExists('dummy'); + $this->assertSession()->linkExists('view'); + $this->assertSession()->linkExists('upload'); + $this->assertSession()->pageTextNotContains('This is dummy widget.'); + $this->assertSession()->responseHeaderContains('X-Drupal-Cache-Contexts', 'eb_dummy'); } /** @@ -130,6 +151,9 @@ class EntityBrowserTest extends EntityBrowserJavascriptTestBase { $this->getSession()->switchToIFrame('entity_browser_iframe_test_entity_browser_file'); $this->assertSession()->selectExists('widget'); + $this->assertSession()->optionExists('widget', 'cbc59500-04ab-4395-b063-c561f0e3bf80'); // Dummy + $this->assertSession()->optionExists('widget', '2dc1ab07-2f8f-42c9-aab7-7eef7f8b7d87'); // Upload + $this->assertSession()->optionExists('widget', '774798f1-5ec5-4b63-84bd-124cd51ec07d'); // View // Selects the view widget. $this->getSession()->getPage()->selectFieldOption('widget', '774798f1-5ec5-4b63-84bd-124cd51ec07d'); @@ -148,10 +172,30 @@ class EntityBrowserTest extends EntityBrowserJavascriptTestBase { // Causes a fatal. // Selects the upload widget. // $this->getSession()->getPage()->selectFieldOption('widget', '2dc1ab07-2f8f-42c9-aab7-7eef7f8b7d87');. + + \Drupal::state()->set('eb_test_dummy_widget_access', FALSE); + $this->drupalGet('entity-browser/iframe/test_entity_browser_file'); + $this->assertSession()->optionNotExists('widget', 'cbc59500-04ab-4395-b063-c561f0e3bf80'); // Dummy + $this->assertSession()->optionExists('widget', '2dc1ab07-2f8f-42c9-aab7-7eef7f8b7d87'); // Upload + $this->assertSession()->optionExists('widget', '774798f1-5ec5-4b63-84bd-124cd51ec07d'); // View + $this->assertSession()->responseHeaderContains('X-Drupal-Cache-Contexts', 'eb_dummy'); + + // Move dummy widget to the first place and make sure it does not appear. + $browser = $this->container->get('entity_type.manager') + ->getStorage('entity_browser') + ->load('test_entity_browser_file'); + $browser->getWidget('cbc59500-04ab-4395-b063-c561f0e3bf80')->setWeight(-15); + $browser->save(); + $this->drupalGet('entity-browser/iframe/test_entity_browser_file'); + $this->assertSession()->optionNotExists('widget', 'cbc59500-04ab-4395-b063-c561f0e3bf80'); // Dummy + $this->assertSession()->optionExists('widget', '2dc1ab07-2f8f-42c9-aab7-7eef7f8b7d87'); // Upload + $this->assertSession()->optionExists('widget', '774798f1-5ec5-4b63-84bd-124cd51ec07d'); // View + $this->assertSession()->pageTextNotContains('This is dummy widget.'); + $this->assertSession()->responseHeaderContains('X-Drupal-Cache-Contexts', 'eb_dummy'); } /** - * Tests wievs selection display. + * Tests views selection display. */ public function testViewsSelectionDisplayWidget() { diff --git a/tests/src/Kernel/Extension/EntityBrowserTest.php b/tests/src/Kernel/Extension/EntityBrowserTest.php index d737f04..018f17d 100644 --- a/tests/src/Kernel/Extension/EntityBrowserTest.php +++ b/tests/src/Kernel/Extension/EntityBrowserTest.php @@ -13,6 +13,7 @@ use Drupal\entity_browser\WidgetInterface; use Drupal\entity_browser\WidgetSelectorInterface; use Drupal\entity_browser\SelectionDisplayInterface; use Drupal\KernelTests\KernelTestBase; +use Drupal\user\Entity\User; use Drupal\views\Entity\View; /** @@ -467,4 +468,41 @@ class EntityBrowserTest extends KernelTestBase { $this->assertEmpty($form_state->getErrors(), t('Validation succeeded where expected')); } + /** + * Tests view widget access. + */ + public function testViewWidgetAccess() { + $this->installConfig(['entity_browser_test']); + $this->installEntitySchema('user'); + $this->installEntitySchema('user_role'); + + /** @var \Drupal\entity_browser\EntityBrowserInterface $entity */ + $entity = $this->controller->load('test_entity_browser_file'); + + $this->assertFalse($entity->getWidget('774798f1-5ec5-4b63-84bd-124cd51ec07d')->access()->isAllowed()); + + // Create a user that has permission to access the view and try with it. + /** @var \Drupal\user\RoleInterface $role */ + $role = $this->container->get('entity_type.manager') + ->getStorage('user_role') + ->create([ + 'name' => $this->randomString(), + 'id' => $this->randomMachineName(), + ]); + $role->grantPermission('access content'); + $role->save(); + + $user = $this->container->get('entity_type.manager') + ->getStorage('user') + ->create([ + 'name' => $this->randomString(), + 'mail' => 'info@example.com', + 'roles' => $role->id(), + ]); + $user->save(); + \Drupal::currentUser()->setAccount($user); + + $this->assertTrue($entity->getWidget('774798f1-5ec5-4b63-84bd-124cd51ec07d')->access()->isAllowed()); + } + }