#1890878: Add modular authentication system, including Http Basic; deprecate global $user

replaced global $user by \Drupal::request()->attributes->get('account'). However, this attribute is not available during access checks e.g. for menu links.

We need to populate account and other attributes to the Request in menu_item_route_access

This is closely related to the problem in #2032553: The _account attribute on the Request is not available during web tests

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

pwolanin’s picture

Issue summary: View changes

improve summary

dawehner’s picture

Status: Active » Needs review
FileSize
3.22 KB

This works on the real page but not in the test.

pwolanin’s picture

Priority: Normal » Major
Status: Needs review » Active

This is actually a big blocker to removing $GLOBALS['user']

pwolanin’s picture

Status: Active » Needs review

oops, missed the patch

dawehner’s picture

FileSize
4.48 KB

Forgot the new file, but the problem is still that the request is not available in the request.

pwolanin’s picture

FileSize
4.52 KB

Fixing the interface name in the test.

pwolanin’s picture

Status: Needs review » Needs work

The last submitted patch, drupal-2040065-5.patch, failed testing.

dawehner’s picture

Issue tags: +MenuSystemRevamp

Just in general, even if this actually touches functionality which better will be removed in the fugure, I think at least the access checker is actually helpful in various places.

Damien Tournoud’s picture

-  $request = Request::create('/' . $href);
+  $request = Request::create('/' . $href, 'GET', Drupal::request()->attributes->all());

This is bogus, given the signature of the method:

Request::create($uri, $method = 'GET', $parameters = array(), $cookies = array(), $files = array(), $server = array(), $content = null)

We are going to need to set the attributes after the request is created. But really, we probably do not want to copy over all the attributes, so we need to figure out some form of whitelist.

tim.plunkett’s picture

Status: Needs work » Needs review
Issue tags: +WSCCI
FileSize
4.57 KB
3.99 KB

Starting to hit this in conversion issues. What about this for now?

dawehner’s picture

+++ b/core/includes/menu.incundefined
@@ -967,6 +967,8 @@ function _menu_link_translate(&$item, $translate = FALSE) {
+  $request->attributes->set('account', Drupal::request()->attributes->get('account') ?: $GLOBALS['user']);

I don't see a reason why we still need the global user? Can you please at least add a comment why this is still needed?

tim.plunkett’s picture

I have no idea *why* its needed, just that during my manual testing, the request didn't always have the account.

tim.plunkett’s picture

FileSize
4.55 KB

Let's see if the bot can tell us anything.

tim.plunkett’s picture

pwolanin’s picture

Status: Needs review » Needs work

The last submitted patch, menu-2040065-15.patch, failed testing.

tim.plunkett’s picture

Priority: Major » Critical
Issue tags: +Stalking Crell

Since maintainers are now bouncing patches for using global $user/user_access(), and spreading the ?: $GLOBALS['user'] hack around core would be unfortunate. We need to find where the _account isn't being set and fix it.

dawehner’s picture

tim.plunkett’s picture

Status: Needs work » Needs review
Issue tags: -MenuSystemRevamp, -WSCCI, -Stalking Crell

#15: menu-2040065-15.patch queued for re-testing.

Status: Needs review » Needs work
Issue tags: +MenuSystemRevamp, +WSCCI, +Stalking Crell

The last submitted patch, menu-2040065-15.patch, failed testing.

dawehner’s picture

Status: Needs work » Needs review
FileSize
1.84 KB
5.62 KB

Reroll and fixing the test.

Status: Needs review » Needs work

The last submitted patch, drupal-2040065-22.patch, failed testing.

dawehner’s picture

Status: Needs work » Needs review
FileSize
515 bytes
5.26 KB

This should fix all of them (just tried to book ones).

andypost’s picture

Status: Needs review » Reviewed & tested by the community
dawehner’s picture

Let's open a new issue for fixing the non existing _account in exception cases.

catch’s picture

Status: Reviewed & tested by the community » Needs review

I can see us having to add more and more attributes individually here. Why not Request::duplicate()?

dawehner’s picture

The problem I see is that you potentially override all kind of variables you would not expect to be there, like upcasted values.

catch’s picture

Status: Needs review » Needs work

#2004086: The Request service must be synthetic has the same problem.

It's not going to fly doing this every single place a new request gets created, so at a minimum there should be a helper for this to centralize the logic. But the fact we're having to do this at all smells very bad indeed.

catch’s picture

Title: When creating a Request object for access checking we need to copy account and other attributes » When creating a Request object for anywhere we need to copy account and other attributes

Re-titling.

dawehner’s picture

catch’s picture

Status: Needs work » Postponed

Yes that's exactly what I was after, postponing.

catch’s picture

Title: When creating a Request object for anywhere we need to copy account and other attributes » Remove _account from request and use the current user service instead.
Category: bug » task
Status: Postponed » Active

That issue's in, is this the right status change?

catch’s picture

Status: Active » Closed (duplicate)
catch’s picture

Issue summary: View changes

link to 2032553