See parent issue #3200985: [meta] Fix undesirable access checking on entity query usages for context and test coverage policy.

The aggregator module uses entity queries in many places that implicitly check access, but this is probably not intended.

Issue fork drupal-3203369

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jonathanshaw created an issue. See original summary.

jonathanshaw opened merge request !420

jonathanshaw’s picture

jonathanshaw
Primary language English
Location Stroud, UK
CreditAttribution: jonathanshaw commented
Title: EntityQuery accessCheck: aggregator module checks access in many places » EntityQuery accessCheck: aggregator module
jonathanshaw’s picture

jonathanshaw
Primary language English
Location Stroud, UK
CreditAttribution: jonathanshaw commented
Priority: Normal » Major

Major because it blocks #2785449: It's too easy to write entity queries with access checks that must not have them

jonathanshaw’s picture

jonathanshaw
Primary language English
Location Stroud, UK
CreditAttribution: jonathanshaw commented
Status: Active » Needs review
andypost’s picture

andypost
he/him
Primary language Russian
CreditAttribution: andypost as a volunteer and at Skilld commented
Status: Needs review » Reviewed & tested by the community

As all this places are used to work without access checks, if someone will add access checks the decoration of storage will be required

  • catch committed cb74339 on 9.2.x 
    Issue #3203369 by jonathanshaw, andypost: EntityQuery accessCheck:...

  • catch committed 8720966 on 9.1.x 
    Issue #3203369 by jonathanshaw, andypost: EntityQuery accessCheck:...
catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch at Third and Grove commented
Version: 9.2.x-dev » 9.1.x-dev
Status: Reviewed & tested by the community » Fixed

Patch looks good, and agreed we don't need explicit test coverage here because query access on aggregator feeds is an extreme edge case.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.