When determining view access to all users for a normal authenticated user $account

entity_metadata_user_access('view', NULL, $account, 'user');

You get the notice

Notice: Trying to get property of non-object in entity_metadata_user_access() (line 661 of /sites/all/modules/contrib/entity/modules/callbacks.inc).

Reason being no isset() check for the entity parameter on line 661.

Reproduction steps:

  1. Create a user with permission 'access user profiles', but not 'administer users'
  2. Run the following:
    $account = user_load([THE_NEW_USER_UID]);
    entity_metadata_user_access('view', NULL, $account, 'user');
    
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jgullstr’s picture

Assigned: jgullstr » Unassigned
Status: Active » Needs review
FileSize
734 bytes
jgullstr’s picture

Issue summary: View changes

Added reproduction steps.

DamienMcKenna’s picture

andersiversen’s picture

I found this issue from the duplicate #2195211: Warning after update. I've applied the patch in #1, but still get the error messages shown in the duplicate (now closed) issue from the ctools module:

Warning: Missing argument 4 for entity_metadata_taxonomy_access() in entity_metadata_taxonomy_access() (string 784 in sites/all/modules/entity/modules/callbacks.inc).
Notice: Undefined variable: entity_type in entity_metadata_taxonomy_access() (string 785 in sites/all/modules/entity/modules/callbacks.inc).

gmercer’s picture

The function entity_metadata_taxonomy_access() needs to have the last param $entity_type set to a default of NULL.

function entity_metadata_user_access($op, $entity = NULL, $account = NULL, $entity_type = NULL) {

Also...

The function entity_metadata_taxonomy_access() needs to have the last param $entity_type set to a default of NULL.

Changed to this:
function entity_metadata_taxonomy_access($op, $entity = NULL, $account = NULL, $entity_type = NULL) {

wodenx’s picture

These are 2 separate issues, and the OP's issue is not addressed in the patch from #7. There is also a 3rd issue - if you use EntityDrupalWrapper::entityAccess() to check 'create' access for a new user entity, you'll get a notice about "unknown property $uid", like:

  $wrapper = entity_property_values_create_entity('user', array('name' => 'myname', 'mail' => 'mymail@my.com'));
  $wrapper->entityAccess('create');

This is again because the callback doesn't check for its presence. Attached patch rolls all these issues together.

wodenx’s picture

Actually - the same issue exists in the user property access callback as well, so rerolled the patch to include that.

zabelc’s picture

This patch seems to work in my development environment. Any chance of committing it so that it's rolled into a release? (I hate to patch prod)

maximpodorov’s picture

Status: Needs review » Reviewed & tested by the community

The patch solves the problems and fixes the strange absence of default values of the last arguments of functions.

fgm’s picture

Status: Reviewed & tested by the community » Needs work

The patch still has at least a problem, though: in some circumstances (like when using restws module, for example), access (entity_metadata_user_access() may be called without an entity, to check view access to all entities of the type, as described in the entity_access() doc. In that case, $entity is null and the test fails although it is expected to succeed : admins bypass the check and do not see the error, but for other users with the access user profiles permission, the final part of the check isset($entity) && $entity->status fails because there is no entity to check, so isset($entity) is FALSE. The check should probably be like this instead:

if (user_access('administer users', $account) || user_access('access user profiles', $account) 
  && $op == 'view'
  && (empty($entity) || !empty($entity->status)
) {
fgm’s picture

Status: Needs work » Needs review
FileSize
2.51 KB

Rerolled as per #21. Split on two lines to make the operator precedence more readable.

gabrielmachadosantos’s picture

Applied and tested the #13 patch. It seems to be working properly. +1 RTBC

gabrielmachadosantos’s picture

Status: Needs review » Reviewed & tested by the community

According to the tests, I'll move it to RTBC.

kopeboy’s picture

How to know when this will be included in a stable release?

I got this error when using an Entity Reference relationship in a view of users

fago’s picture

Status: Reviewed & tested by the community » Fixed

Thanks, committed.

  • fago committed c3dcf41 on 7.x-1.x
    Issue #2160355 by wodenx, gmercer, fgm, jgullstr: Fixed Trying to get...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

sano’s picture

I see a similar issue to the one described in #12, when the entity_metadata_taxonomy_access() is called in cases when the $entity object does not exist. Do I need to create a new issue, or can we reopen this one to track this problem? The error message I see is:

Notice: Trying to get property of non-object in entity_metadata_taxonomy_access() (line 827 of /var/www/rovdev/sites/all/modules/entity/modules/callbacks.inc).

The problem can be fixed by adding an isset() check for existence of $entity on line 826. I could produce a patch if desired.

Chris Burge’s picture

Re #20, issue is opened at #3018226: Trying to get property of non-object in entity_metadata_taxonomy_access(). Patch attached to that issue checks for $entity before trying to access its properties.