diff --git a/core/modules/rest/src/Plugin/rest/resource/EntityResource.php b/core/modules/rest/src/Plugin/rest/resource/EntityResource.php index 6084fbc..64d1e1b 100644 --- a/core/modules/rest/src/Plugin/rest/resource/EntityResource.php +++ b/core/modules/rest/src/Plugin/rest/resource/EntityResource.php @@ -9,6 +9,7 @@ use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityStorageException; use Drupal\rest\Plugin\ResourceBase; +use Drupal\rest\ResourceAccessTrait; use Drupal\rest\ResourceResponse; use Drupal\rest\ResourceValidationTrait; use Psr\Log\LoggerInterface; @@ -37,6 +38,7 @@ class EntityResource extends ResourceBase implements DependentPluginInterface { use ResourceValidationTrait; + use ResourceAccessTrait; /** * The entity type targeted by this resource. diff --git a/core/modules/rest/src/Plugin/rest/resource/UserRegistrationResource.php b/core/modules/rest/src/Plugin/rest/resource/UserRegistrationResource.php index 6899058..3ad7e28 100644 --- a/core/modules/rest/src/Plugin/rest/resource/UserRegistrationResource.php +++ b/core/modules/rest/src/Plugin/rest/resource/UserRegistrationResource.php @@ -5,6 +5,7 @@ use Drupal\Core\Config\ImmutableConfig; use Drupal\Core\Session\AccountInterface; use Drupal\rest\ModifiedResourceResponse; +use Drupal\rest\ResourceAccessTrait; use Drupal\user\UserInterface; use Psr\Log\LoggerInterface; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -28,6 +29,7 @@ class UserRegistrationResource extends ResourceBase { use ResourceValidationTrait; + use ResourceAccessTrait; /** * User settings config instance. diff --git a/core/modules/rest/src/ResourceAccessTrait.php b/core/modules/rest/src/ResourceAccessTrait.php new file mode 100644 index 0000000..2385a20 --- /dev/null +++ b/core/modules/rest/src/ResourceAccessTrait.php @@ -0,0 +1,28 @@ +_restSubmittedFields as $key => $field_name) { + if (!$entity->get($field_name)->access('edit')) { + throw new AccessDeniedHttpException("Access denied on creating field '$field_name'."); + } + } + } + +} + diff --git a/core/modules/rest/src/ResourceValidationTrait.php b/core/modules/rest/src/ResourceValidationTrait.php index 5189111..f8576a7 100644 --- a/core/modules/rest/src/ResourceValidationTrait.php +++ b/core/modules/rest/src/ResourceValidationTrait.php @@ -3,7 +3,6 @@ namespace Drupal\rest; use Drupal\Core\Entity\EntityInterface; -use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException; trait ResourceValidationTrait { @@ -37,21 +36,4 @@ protected function validate(EntityInterface $entity) { } } - /** - * Checks access for entity fields. - * - * @param \Drupal\Core\Entity\EntityInterface $entity - * The entity object. - */ - protected function checkFieldAccess($entity) { - // Only check 'edit' permissions for fields that were actually submitted by - // the user. Field access makes no difference between 'create'and 'update', - // so the 'edit' operation is used here. - foreach ($entity->_restSubmittedFields as $key => $field_name) { - if (!$entity->get($field_name)->access('edit')) { - throw new AccessDeniedHttpException("Access denied on creating field '$field_name'."); - } - } - } - } diff --git a/core/modules/rest/tests/src/Unit/ResourceValidationTraitTest.php b/core/modules/rest/tests/src/Unit/ResourceValidationTraitTest.php index c6d6912..378a193 100644 --- a/core/modules/rest/tests/src/Unit/ResourceValidationTraitTest.php +++ b/core/modules/rest/tests/src/Unit/ResourceValidationTraitTest.php @@ -7,6 +7,7 @@ use Drupal\node\Entity\Node; use Drupal\Tests\UnitTestCase; use Drupal\user\Entity\User; +use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException; use Symfony\Component\Validator\ConstraintViolationInterface; /** @@ -37,9 +38,6 @@ public function testValidate() { /** * @covers ::validate - * - * @expectedException \Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException - * @expectedException UserRegistrationResourceTest::ERROR_MESSAGE */ public function testFailedValidate() { $violation1 = $this->prophesize(ConstraintViolationInterface::class); @@ -68,6 +66,8 @@ public function testFailedValidate() { $method = new \ReflectionMethod($trait, 'validate'); $method->setAccessible(TRUE); + $this->setExpectedException(UnprocessableEntityHttpException::class); + $method->invoke($trait, $entity->reveal()); } } diff --git a/core/modules/rest/tests/src/Unit/UserRegistrationResourceTest.php b/core/modules/rest/tests/src/Unit/UserRegistrationResourceTest.php index 69c5b0d..12d1190 100644 --- a/core/modules/rest/tests/src/Unit/UserRegistrationResourceTest.php +++ b/core/modules/rest/tests/src/Unit/UserRegistrationResourceTest.php @@ -8,6 +8,8 @@ use Drupal\Tests\UnitTestCase; use Drupal\user\Entity\User; use Psr\Log\LoggerInterface; +use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; +use Symfony\Component\HttpKernel\Exception\BadRequestHttpException; /** * Only administrators can create user accounts. @@ -94,32 +96,25 @@ protected function setUp() { /** * Tests that an exception is thrown when no data provided for the account. - * - * @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException - * @expectedExceptionMessage No user account data for registration received. */ public function testEmptyPost() { + $this->setExpectedException(BadRequestHttpException::class); $this->testClass->post(NULL); } /** * Tests that only new user accounts can be registered. - * - * @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException - * @expectedExceptionMessage An ID has been set and only new user accounts can be registered. */ public function testExistedEntityPost() { $entity = $this->prophesize(User::class); $entity->isNew()->willReturn(FALSE); + $this->setExpectedException(BadRequestHttpException::class); $this->testClass->post($entity->reveal()); } /** * Tests that admin permissions are required to register a user account. - * - * @expectedException \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException - * @expectedExceptionMessage You cannot register a new user account. */ public function testRegistrationAdminOnlyPost() { @@ -132,14 +127,13 @@ public function testRegistrationAdminOnlyPost() { $entity = $this->prophesize(User::class); $entity->isNew()->willReturn(TRUE); + $this->setExpectedException(AccessDeniedHttpException::class); + $this->testClass->post($entity->reveal()); } /** * Tests that only anonymous users can register users. - * - * @expectedException \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException - * @expectedExceptionMessage Only anonymous users can register users. */ public function testRegistrationAnonymousOnlyPost() { $this->currentUser->isAnonymous()->willReturn(FALSE); @@ -149,6 +143,8 @@ public function testRegistrationAnonymousOnlyPost() { $entity = $this->prophesize(User::class); $entity->isNew()->willReturn(TRUE); + $this->setExpectedException(AccessDeniedHttpException::class); + $this->testClass->post($entity->reveal()); } } diff --git a/core/modules/simpletest/src/WebTestBase.php b/core/modules/simpletest/src/WebTestBase.php index 04d1927..cb454a1 100644 --- a/core/modules/simpletest/src/WebTestBase.php +++ b/core/modules/simpletest/src/WebTestBase.php @@ -2680,7 +2680,7 @@ protected function prepareRequestForGenerator($clean_urls = TRUE, $override_serv * Options to be passed to Url::fromUri(). * * @return string - * An absolute URL string. + * An absolute URL stsring. */ protected function buildUrl($path, array $options = array()) { if ($path instanceof Url) {