Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
If there is reference to "deleted" entity, the referencing entity can't be saved/changed anymore.
There is a validation error: This entity (node: 11729) cannot be referenced.
And on the reference field, instead of label the "- Restricted access - (11729)" is displayed.
Even if user has "View deleted entities" permission.
An additional problem is custom code that outputs entity-derived data (e.g. counts of referenced entities) without going through access checks.
Proposed resolution
1. Prevent trashed entities from being returned by entity_load
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | 3370639-followup.patch | 4.91 KB | amateescu |
| #5 | 3370639.patch | 7 KB | amateescu |
| #4 | reference_to_deleted_entity-3370639-4.patch | 9.54 KB | kala4ek |
Comments
Comment #2
kala4ekComment #3
kala4ekComment #4
kala4ekAlso need to override default ValidReference constraint.
Comment #5
amateescu commentedI've been thinking about this problem for a while, and finally decided to go in a (somewhat radical) different direction: Trash needs to prevent entity_load from returning trashed entities completely.
This was based on observations from custom code on various sites, and the problem that stood out the most was that there are cases where entity-derived data is displayed without going through access checks, for example directly outputting the result of
count($entity->get('some_reference_field')->referencedEntities()), which internally does an entity_load_multiple, but doesn't run any access checks. This specific example could've been solved by overriding core's field item list class for ER fields, but then contrib/custom code that also override it wouldn't benefit from our changes.This decision is also in line with the recent fix from #3393095: Trash breaks revision-based views and relation queries, which made all views (using either the
dataor therevision dataas the base table) stop returning trashed entities by default.Comment #6
amateescu commentedCommitted the patch from #5 to 3.x: https://git.drupalcode.org/project/trash/-/commit/bb2eba9573a927bcfce7f7...
Comment #8
amateescu commentedNow that we don't return anything on entity_load, we need different approaches for trash routes (restore, purge) and for viewing trashed entities.
Committed the followup patch attached to 3.x.
Comment #10
kala4ekHm, but how it will works with entity edit forms? Looks like now trashed entites wouldn't displayed in referency fields anymore and after submitting the form, reference would gone. That means if the admin will restore the trashed node, it wouldn't appears at the place where it was before...
Comment #11
amateescu commented@kala4ek, that's right, the new behavior is closer to the entity being actually deleted, which matches the scenario you described. Fixing the problem within
\Drupal\Core\Field\EntityReferenceFieldItemList::referencedEntities()would have had the same outcome.