Now that #1780646: entity_access() fails to check node type specific create access is fixed we should remove this temporary hack and rely on the default access callback of the entity API again.

CommentFileSizeAuthor
#1 restws-property-access-2237879-1.patch3.6 KBklausi

Comments

klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Active » Needs review
StatusFileSize
new restws-property-access-2237879-1.patch3.6 KB

Patch attached, I'm glad that we have the test cases to catch our special use case of property/field access.

muschpusch’s picture

muschpusch commented

The patch isn't working for me. I also tried it in combination with #1720602. At least i don't need to give the 'bypass node access permission' anymore but administer content is still required.

[edit]I use entity API 1.4 and dev version of restws[/edit]

muschpusch’s picture

muschpusch commented
Status: Needs review » Needs work

ok after having a better look at this. The problem is in the part of the code which is checking for the $info['access callback'] if that one isn't set it checks for the setter permission, which is 'administer nodes' at least for the "sticky" and "status"properties of nodes. Should we just exclude those from the check?

  • Commit 33d8390 on 7.x-2.x by klausi: 
    Issue #2237879 by klausi: Remove custom restws_entity_node_access() hack...
klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Needs work » Fixed

This issue is only about fixing the temporary hack, if there is something left to do for nodes we should have a separate issue. "sticky" and "status" are access protected properties that require the administer nodes permission. Did you try to just leave them out in your POST/PUT request?

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.