Link fields do not check access for entity refs [#2968609]

A 'link' field allows users to either enter an external link or use autocomplete for an existing entity in the system. If a user enters an autocompleted node with restricted access into a link field (entity reference - not a hardcoded path), the link will still print.

Consider the following:
- Clean D8 install - create a custom block_content block with one 'link' field with unlimited cardinality
- Add two 'Articles' - one published, one unpublished
- Add both articles to your new block_content block just created
- Place the block
- Note both articles print

Ideally this would work like the entity reference field, and when we know we have a entity ref to a node, access would be respected for those.

I tried searching issue queue for similar report (thought there may be some history behind this issue), but didn't find anything. Apologies if this is a duplicate.

Comment	File	Size	Author
#20	drupal-link-entity-access-2968609-20.patch	11.77 KB	codebymikey
#20
#17	drupal-link-entity-access-2968609-17-LINK-FUNCTIONAL-TEST-ONLY.patch	12.78 KB	codebymikey
#17	9.3.x: PHP 7.3 & MariaDB 10.3.22 73 pass, 2 fail
#16	interdiff_14-15.txt	4.98 KB	codebymikey
#15	drupal-link-entity-access-2968609-15.patch	11.5 KB	codebymikey
#15	9.3.x: PHP 7.3 & MariaDB 10.3.22 28,924 pass, 2 fail PHP 7.3 & SQLite 3.28 28,923 pass, 4 fail PHP 7.4 & SQLite 3.27 28,924 pass, 2 fail
#14	drupal-link-entity-access-2968609-14.patch	11.52 KB	codebymikey
#14
#12	drupal-link-entity-access-2968609-12.patch	11.5 KB	codebymikey
#12	9.3.x: PHP 8.0 & MySQL 5.7 28,896 pass, 12 fail
#6	2968609-6.patch	3.69 KB	dpagini
#6	8.6.x: PHP 7.1 & MySQL 5.5 24,294 pass, 2 fail
#5	2968609-5.patch	3.71 KB	dpagini
#5	8.7.x: PHP 7.1 & MySQL 5.5 Unable to generate test groups

Issue fork drupal-2968609

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

2968609-link-fields-do changes, plain diff MR !1313
Check out this branch

About issue forks

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

1 May 2018 at 20:13

trwill created an issue. See original summary.

Comment #2

trwill CreditAttribution: trwill commented 9 May 2018 at 13:24

Issue summary:

View changes

Comment #3

trwill CreditAttribution: trwill commented 16 August 2018 at 18:45

Any thoughts?

Comment #4

16 August 2018 at 18:45

Version:

8.5.x-dev

» 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Comment #5

dpagini CreditAttribution: dpagini as a volunteer commented 14 September 2018 at 20:02

File	Size
2968609-5.patch	3.71 KB
8.7.x: PHP 7.1 & MySQL 5.5 Unable to generate test groups

Adding a (hopefully) failing test to demonstrate the expected behavior.

Comment #6

dpagini CreditAttribution: dpagini as a volunteer commented 14 September 2018 at 20:26

File	Size
2968609-6.patch	3.69 KB
8.6.x: PHP 7.1 & MySQL 5.5 24,294 pass, 2 fail

1 file was hidden/shown/deleted

File	Size
2968609-5.patch	3.71 KB
8.7.x: PHP 7.1 & MySQL 5.5 Unable to generate test groups

Comment #7

14 September 2018 at 20:26

Version:

8.6.x-dev

» 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Comment #8

14 September 2018 at 20:26

Version:

8.8.x-dev

» 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Comment #9

quietone CreditAttribution: quietone as a volunteer commented 27 December 2020 at 07:23

Component:

field system

» link.module

Comment #10

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 6 October 2021 at 15:47

Version:

8.9.x-dev

» 9.3.x-dev

Comment #11

11 October 2021 at 14:13

codebymikey opened merge request !1313

Comment #12

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 11 October 2021 at 14:15

Status:

Active

» Needs review

File	Size
drupal-link-entity-access-2968609-12.patch	11.5 KB
9.3.x: PHP 8.0 & MySQL 5.7 28,896 pass, 12 fail

1 file was hidden/shown/deleted

File	Size
2968609-6.patch	3.69 KB
8.6.x: PHP 7.1 & MySQL 5.5 24,294 pass, 2 fail

Comment #13

11 October 2021 at 15:15

Status:

Needs review

» Needs work

The last submitted patch, 12: drupal-link-entity-access-2968609-12.patch, failed testing. View results

Comment #14

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 13 October 2021 at 13:59

File	Size
drupal-link-entity-access-2968609-14.patch	11.52 KB

1 file was hidden/shown/deleted

File	Size
drupal-link-entity-access-2968609-12.patch	11.5 KB
9.3.x: PHP 8.0 & MySQL 5.7 28,896 pass, 12 fail

Updated patch to take into account unrouted URLs.

Comment #15

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 13 October 2021 at 14:40

File	Size
drupal-link-entity-access-2968609-15.patch	11.5 KB
9.3.x: PHP 7.3 & MariaDB 10.3.22 28,924 pass, 2 fail PHP 7.3 & SQLite 3.28 28,923 pass, 4 fail PHP 7.4 & SQLite 3.27 28,924 pass, 2 fail

1 file was hidden/shown/deleted

File	Size
drupal-link-entity-access-2968609-14.patch	11.52 KB

Ensure the entity access check also applies on plain text links.

Comment #16

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 13 October 2021 at 14:42

File	Size
interdiff_14-15.txt	4.98 KB

Comment #17

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 15 October 2021 at 09:38

File	Size
drupal-link-entity-access-2968609-17-LINK-FUNCTIONAL-TEST-ONLY.patch	12.78 KB
9.3.x: PHP 7.3 & MariaDB 10.3.22 73 pass, 2 fail

Uploading a patch that allows HTML artifacts to be displayed on DrupalCI.

The current implementation of DrupalCI is unable to sufficiently copy the assets into the appropriate directories since there are a lot of generated files.

Comment #18

15 October 2021 at 09:38

Version:

9.3.x-dev

» 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Comment #19

15 October 2021 at 09:38

Version:

9.4.x-dev

» 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Comment #20

codebymikey CreditAttribution: codebymikey at Zodiac Media commented 11 July 2022 at 16:01

File	Size
drupal-link-entity-access-2968609-20.patch	11.77 KB

Updated the variables so that it doesn't accidentally overwrite the original $entity variable retrieved from FieldItemListInterface $items

Comment #21

11 July 2022 at 16:01

Version:

9.5.x-dev

» 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Comment #22

11 July 2022 at 16:01

Version:

10.1.x-dev

» 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.