Problem/Motivation

Follow-up to #2696669: Incomplete/broken access checking in EntityController::addPage()

There are inconsistent usages of "add-form" and "add-page" link templates in test entities.
E.g.
entity_test uses "add-form" = "/entity_test/add" and
entity_test_with_bundle uses it as "add-form" = "/entity_test_with_bundle/add/{entity_test_bundle}"

Proposed resolution

Steps to reproduce

Proposed resolution

Fix link templates in test entities and update tests. See #35

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-2699959

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

mbovan created an issue. See original summary.

chaitanya17’s picture

As its public directory you should have writable(777) permission. Also try to hit specific image file in browser what output it generates. Other way it might be issue of Varnish configuration on server.

kristiaanvandeneynde’s picture

Are we sure this is a bug? It seems perfectly logical to me that a single-bundle entity uses /foo/add, whereas a bundleable entity needs to use /foo/add/bar.

Example of a single-bundle entity: /user/add
Example of a bundleable entity: /node/add/page

P.S.: The comment in #2 makes zero sense here, posted on the wrong issue? :)

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

joachim’s picture

Issue tags: +Novice

> Are we sure this is a bug? It seems perfectly logical to me that a single-bundle entity uses /foo/add, whereas a bundleable entity needs to use /foo/add/bar.

Agreed.

The code in DefaultHtmlRouteProvider::getAddFormRoute() says:

      // @todo: We have to check if a route contains a bundle in its path as
      //   test entities have inconsistent usage of "add-form" link templates.
      //   Fix it in https://www.drupal.org/node/2699959.
      if (($bundle_key = $entity_type->getKey('bundle')) && strpos($route->getPath(), '{' . $expected_parameter . '}') !== FALSE) {

so it sounds like the problem might be that some test entities have bundles, but incorrectly have an add form path without a bundle placeholder.

So I guess the next step is to remove the logic in DefaultHtmlRouteProvider::getAddFormRoute() and see if tests still pass. If any test entities fail, see what's wrong with their link templates.

nginex’s picture

Issue tags: +LutskGCW19
dragos-dumi’s picture

StatusFileSize
new1.22 KB

Removing the route param check and run the tests here

dragos-dumi’s picture

Issue tags: +DevDaysTransylvania
dragos-dumi’s picture

Version: 8.6.x-dev » 8.7.x-dev
dragos-dumi’s picture

StatusFileSize
new2 KB
dragos-dumi’s picture

dragos-dumi’s picture

StatusFileSize
new954 bytes
dragos-dumi’s picture

StatusFileSize
new1.93 KB

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.9 was released on November 6 and is the final full bugfix release for the Drupal 8.7.x series. Drupal 8.7.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.8.0 on December 4, 2019. (Drupal 8.8.0-beta1 is available for testing.)

Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

shobhit_juyal’s picture

Issue summary: View changes

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

lendude’s picture

Category: Bug report » Task
Issue tags: +Bug Smash Initiative

This came up as a daily triage target for the Bug Smash Initiative.

We discussed this and agreed with #3 and #9 that this should not be bug. Cleaning up the test entities should probably be a task, so moving it to that.

sunset_bill’s picture

With the addition of bundle classes in 9.3, it looks like this might no longer be limited to tests. I've got a couple of bundle classes that extend from a content entity (created by drush generate), and trying to get to my_type/add/bundle_id with them gets a 404. However, when I add a content type for my content entity the old way, in the UI, the same path gets the Add page.

The add-form link generated for my content type is
"add-form" = "/my-content/add/{my_content_type}"

Going through things with a debugger, an Add request for one of my bundle classes never gets to EntityForm::getEntityFromRouteMatch(). So bundle classes are not being handled in the same way as traditional content types.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone made their first commit to this issue’s fork.

quietone’s picture

quietone’s picture

Status: Active » Needs review
smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Do a search for entity_test/add' and 'entity_test_mulrevpub/add' believe all instances have been found.

quietone’s picture

Status: Reviewed & tested by the community » Needs review

There was a test failure. I rebased and updated another link.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Additional link change seems fine.

larowlan’s picture

Status: Reviewed & tested by the community » Needs work

The changes to the link templates here look good, but I'm concerned about the impact on contrib modules that are using these entity types for their tests. This can be seen by the large number of changes in the MR to add the additional type to the URL.

Can we try to revert all of those changes, and as well as fixing the add-form template, add an add-page template (using the original URL).

For instances where there's only one bundle, that will wire up \Drupal\Core\Entity\Controller\EntityController::addPage which handily redirects to the add-form template when there is only one bundle. For the vast majority of tests, there will only be one bundle because of the default value in \entity_test_entity_bundle_info

We can then assess how many tests are still broken, but I suspect it will be dramatically less. That will give us confidence that this change won't break as many contrib tests as the current approach most likely will.

quietone’s picture

Status: Needs work » Needs review

@larowlan, thanks.

Made changes asked for in #35.

larowlan’s picture

Awesome, passes 🎉

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Feedback appears to be addressed here

needs-review-queue-bot’s picture

Status: Reviewed & tested by the community » Needs work
StatusFileSize
new90 bytes

The Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

quietone’s picture

Issue summary: View changes
Status: Needs work » Needs review
smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Rebase seems good.

larowlan’s picture

Status: Reviewed & tested by the community » Needs work

Updated credits.

There's one here still using annotations that I think should be attributes?

quietone’s picture

Status: Needs work » Reviewed & tested by the community

It would be out of scope for this issue to convert an entity from annotations to attributes. That entity was added in #3310170: Use UUID as entity ID and there is a comment there suggesting that the conversion could be done as part of deprecating annotations, [#33101701-50]. That seems reasonable for a test entity.

larowlan’s picture

Yes you're correct, sorry for missing that was already using annotations rather than it being added here

  • larowlan committed be3b0198 on 11.x
    Issue #2699959 by quietone, dragos-dumi, smustgrave, larowlan, joachim:...
larowlan’s picture

Status: Reviewed & tested by the community » Fixed

Committed to 11.x
As we're in RC phase for 11.1 I think this doesn't meet the requirements for backport.

Thanks all 🏆️

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.