entity_access() stops working with undocumented usage

By joachim on 20 January 2014

Change record status:

Published (View all published change records)

Project:

Entity API

Introduced in version:

7.x-1.3

Issue links:

https://www.drupal.org/node/1780646

Description:

It turns out that entity_access() was used wrongly by some people previously, i.e. they passed the node-type-name instead as a whole node object as supported by node_access(). However, there was never the intention nor the documentation that entity_access() supports that, i.e. this was a bug which has been fixed now.

This undocumented usage does not work any more, please use it as the following examples show:

// Nodes.
$node = entity_create('node', array('type' => 'page'));
$access = entity_access('create', 'node', $node, $account);

// Custom entity.
$entity = entity_create('my_entity', array('bundle-key-name' => 'bundle_name'));
$access = entity_access('create', 'my_entity', $entity, $account);

Impacts:

Module developers

Updates Done (doc team, etc.)

Online documentation:

Not done

Theming guide:

Not done

Module developer documentation:

Not done

Examples project:

Not done

Coder Review:

Not done

Coder Upgrade:

Not done

Other:

Other updates done

Comments

This is incorrect.

JvE commented 21 January 2014 at 07:26

This is incorrect.
$entity has always been optional and still is. And it has always been an entity and never a bundle string like node_access().

entity_access($op, $entity_type, $entity = NULL, $account = NULL)
* @param $op
* The operation being performed. One of 'view', 'update', 'create' or
* 'delete'.
* @param $entity_type
* The entity type of the entity to check for.
* @param $entity
* Optionally an entity to check access for. If no entity is given, it will be
* determined whether access is allowed for all entities of the given type.
* @param $account
* The user to check for. Leave it to NULL to check for the global user.

The actual change introduced in this release is that an exception is thrown rather than a notice on invalid use.
And a bug is fixed where a notice was generated in valid use cases.

No change in the way entity_access is called is required unless you were already doing it wrong.