View argument validators are not taken into account in access checks

Working with @rcodina on the major issue triage at DrupalCon Barcelona 2015

Discussed with @alexpott, @dawehner, @effulgentsia, and @xjm.
The fact that it shows links that will always 404, and since this is a regression from D7, and it has no reasonable or known workaround, this is definitely a major bug.

Just by looking into the local task subsystem, I think this would actually even require a change in there. This seems not possible at the moment, to be honest.

Possible workaround:

1. Install the Views Advanced Routing module.
2. Enable 'Views Advanced Routing' as described on the project page.
3. On the Views route settings, set a requirement, for example:
   _custom_access: '\Drupal\mymodule\Controller\MyController::access'
4. If the requirement is of type '_custom_access', implement this access checker.
   Example access checker for displaying the menu tab only on nodes of type 'article':

   
   namespace Drupal\mymodule\Controller;
   
   use Drupal\node\Entity\Node;
   use Drupal\Core\Access\AccessResult;
   
   /**
    * Controls access for the view 'myview'.
    */
   class MyController {
   
     /**
      * Checks access for the view 'myview'.
      *
      * @param int $node
      *   The node ID.
      */
     public function access($node) {
       $node_object = Node::load($node);
   
       if (!$node_object) {
         return AccessResult::forbidden(strtr('Node @node_id not found.', [
           '@node_id' => $node,
         ]));
       }
   
       if ($node_object->bundle() != 'article') {
         return AccessResult::forbidden(strtr('Node @node_id is not an article.', [
           '@node_id' => $node,
         ]));
       }
   
       // In all other cases, access is granted.
       return AccessResult::allowed();
     }
   
   }
   

Caveats of this workaround:

• accessing the view page for an invalid object will result into a '403 Forbidden' instead of what was configured on the view (for example a '404 Not Found').
• The parameter name ($node in the example) MUST exactly match the parameter name configured on the View's path (for example: /node/%node/something).

Access check service

Instead of using '_custom_access' as access checker, you can also implement an 'access_check' service. See for an example the RNG module.
From rng.services.yml:

access_check.rng.entity_is_event:
  class: Drupal\rng\Access\EntityIsEventCheck
  arguments: ['@rng.event_manager']
  tags:
    - { name: access_check, applies_to: _entity_is_event }

More information about access checking on routes:
https://www.drupal.org/node/2122195

Hi,
I have come across this issue today on a new D8 site.. Is there a fix or workaround for this issue?
Thanks..

I think this is a duplicate of https://www.drupal.org/project/drupal/issues/2778345

I'd have to revisit it to get my head around it again and update it for 8.7 but I seem to remember that my patch worked.

This is definitely a duplicate of 2778345. I've just tested it and it still works although the patch failed to apply. I had to add the lines manually to views.services.yml.

I'll clean it up and hopefully get it in better shape for 8.7.

I've updated https://www.drupal.org/project/drupal/issues/2778345

I believe that solves this.

This issue is actually older (and already determined to be major as per #7) so let's mark the other one a duplicate. Moving @tetranz's patch here for convenience.

Never mind, the other issue is more to the point, sorry about that. Escalating it instead.