Problem/Motivation
Implementing node access through the $query->addTag('node_access') method requires queries that do not use {node} as base table to explicitly define the base table through $query->addMetaData('base_table', table).
At the moment, while it allows modules to add the node_access tag via 'query access tag' in hook_views_data(), views does not allow passing query metadata via that same hook. This is holding up some of the list-to-views conversion issues such as #2020387: Convert "Active forum topics" block to a View, since the query node_access tag on a non-node base table causes exceptions:
Exception: Query tagged for node access but there is no node table, specify the base_table using meta data. in node_query_node_access_alter() (line 1867 of /d8/core/modules/node/node.module).
For background, see
- Document the use of metadata to indicate a base table for node access queries
- Always use query metadata to specify the node access base table
- Converting node access queries to 7.3
- SA-CORE-2011-002 - Drupal core - Access bypass
Proposed resolution
Allow modules to pass query metadata along with the 'query access tag' in hook_views_data().
Here's how this would look for the forum module:
/**
* Implements hook_views_data().
*/
function forum_views_data() {
$data['forum_index']['table']['group'] = t('Forum');
$data['forum_index']['table']['base'] = array(
'field' => 'nid',
'title' => t('Forum content'),
'access query tag' => 'node_access',
'query metadata' => array('base_table' => 'forum_index'),
);
...
Remaining tasks
User interface changes
None.
API changes
One more key (for example 'query metadata') added to the hook_views_data return value.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | interdiff.txt | 738 bytes | dawehner |
| #4 | vdc-2099511.patch | 3.71 KB | dawehner |
| #3 | vdc-2099511.patch | 3.84 KB | dawehner |
| #3 | interdiff.txt | 843 bytes | dawehner |
| #1 | interdiff.txt | 3.68 KB | dawehner |
Comments
Comment #1
dawehnerWow, I was not aware of that functionality. Thanks for working on that patch!
I decided to try to write a proper test for it, and really got confused about the fact that they did not passed ... You missed some curly braces.
Comment #2
damiankloip commentedSorry, but why?
might as well assert identical it?
Comment #3
dawehnerThere is a lot of additional stuff to test in the execute method in the future.
Comment #4
dawehnerComment #5
damiankloip commentedThank you! This looks good.
Comment #6
xjm4: vdc-2099511.patch queued for re-testing.
Comment #7
dawehner.
Comment #8
webchickCommitted and pushed to 8.x. Thanks!
We'll need a change notice to explain which modules need to use this and why/how.
Comment #9
xjmSending over to Views-land.
Comment #10
chris matthews commentedFor more information as to why this issue was moved to the Drupal core project, please see issue #3030347: Plan to clean process issue queue
Comment #11
chris matthews commentedMoving back to the contributed Views issue queue and closing as outdated per https://www.drupal.org/project/views/issues/3030347#comment-13023447