Problem/Motivation

Notice: Trying to get property of non-object in profile2_access() (line 706 ofprofile2/profile2.module).

profile2_access() has an optional second parameter but tries to use $profile->type right away.

Proposed resolution

Check variables before trying to use them.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

joelpittet created an issue. See original summary.

joelpittet’s picture

Status: Active » Needs review
StatusFileSize
new1.04 KB

How about this? It also makes a slight improvement to the administer profiles for micro performance optimization.

spleshka’s picture

Hi Joël, the fix looks quite good & obvious, I'm happy to commit it. Just before I did it - can you please tell me how can I reproduce the similar issue? Thanks.

joelpittet’s picture

I just noticed in my error log and doesn't happen often.

Though if profile is default null like the docs say it can be it with throw this notice

spleshka’s picture

If we don't know the reason of this issue then I'm not sure that the suggested fix solves it. Can you tell me if the backlog shows you that notices are thrown by a user with "administer profiles" permission?

joelpittet’s picture

@Spleshka it does fix it because your function parameter defaults to NULL and the docs say it is optional.

 * @param $profile
 *   (optional) A profile to check access for. If nothing is given, access for
 *   all profiles is determined.

So regardless of where the error came from the expected code path of an optional profile is that it can deal with $profile being not a profile object and therefore doesn't have a type property.

To reproduce just call:

profile2_access($op = 'view');

Here's some tests to help prove this. Also I noticed the defaults on $account weren't defaulting like the param docblock says so I added a test for that too.

joelpittet’s picture

The last submitted patch, 6: profile2_access_has-2603636-6-tests-only.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 6: profile2_access_has-2603636-6.patch, failed testing.

joelpittet’s picture

Status: Needs work » Needs review
StatusFileSize
new1.81 KB
new1.3 KB
new2.42 KB

Whoops too used to D8's short array syntax.

The last submitted patch, 10: profile2_access_has-2603636-6-tests-only.patch, failed testing.

joelpittet’s picture

StatusFileSize
new674 bytes
new2.58 KB

Whoops, don't use #10 that opens up some security issues because there is a $user variable in that function. I renamed it and this one is much better.

spleshka’s picture

StatusFileSize
new1.38 KB
new2.79 KB

Thanks for the patch with test, @joelpittet. My only concern about your patch is that you change the behavior of the $account variable. Previously, when profile2_access() were used without 3rd argument then hook_profile2_access() passed NULL as a third param. Your patch changes this behavior to always have an object there. So if somebody implemented that hook and checked $account variable using empty/isset functions (or NULL), then this patch will introduce issues. Also I don't see a necessity to change the behavior for the $account variable. I've updated the patch with minor change in the code logic & removed the force set of $account variable. How does it look to you now?

joelpittet’s picture

@Spleshka I did that because that's what user_access() does it. But since user_access() does that for itself and I'd have to assume that the implementations of hook_profile2_access() can deal with the NULL value already, then that is fine.

I guess I can't RTBC my own patch but maybe you feel comfortable enough with the tests and such that it's worth committing?

  • Spleshka committed 3eb536f on 7.x-1.x authored by joelpittet
    Issue #2603636 by joelpittet, Spleshka: profile2_access() has an...
spleshka’s picture

Status: Needs review » Fixed

Commited. Thanks for the issue, @joelpittet.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

thomas bosviel’s picture

Status: Closed (fixed) » Needs review
StatusFileSize
new724 bytes

I think this commit introduces a bug. Roles assigned to the profile type are never checked.

rickj’s picture

Status: Needs review » Closed (duplicate)

The bug in #18 was identified and corrected in #2683917, now committed.