The view access check for an entity reference field property will fail when it should pass given the following conditions:

1. The user has the proper privileges to create a node of a given bundle
2. That bundle has an entity reference field to another node bundle.
3. The user has the proper privileges to view nodes of the referenced bundle.
4. The entity reference field does not have a value.

To reproduce:

// Make sure the user has permission to create articles and view published issues.
global $user;

// Create the article node and get its wrapper.
$values = array('type' => 'article');
$entity = entity_create('node', $values);
$wrapper = entity_metadata_wrapper('node', $entity);

// Check access on an entity reference field without a value.
$access = $wrapper->field_article_issue->access('view', $user);

// $access will always be false.

The above is adapted from https://github.com/RESTful-Drupal/restful/issues/405#issuecomment-102811672. That issue on the restful project appears to be caused by this bug.

This happens because entity_acess() is invoked with a null value for $entity. That in turn calls the hook entity_metadata_no_hook_node_access() which will always return FALSE unless the user has permission to bypass node access or view all nodes.

Perhaps an appropriate solution would be to bypass entityAccess() in EntityDrupalWrapper::access() if the field has no value (and thus no entity to check access against). I'm attaching a patch to that effect.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

chasingmaxwell created an issue. See original summary.

chasingmaxwell’s picture

chasingmaxwell’s picture

Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, 2: skip_entity_access_on_null_value-2709457-2.patch, failed testing.

chasingmaxwell’s picture

Oops, my last patch had a typo in it.

chasingmaxwell’s picture

chasingmaxwell’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 5: skip_entity_access_on_null_value-2709457-5.patch, failed testing.

chasingmaxwell’s picture

Well, it looks like my patch introduced a legitimate regression. I was kind of wondering if this change was too big a hammer. I'd definitely appreciate input about a better way to address this.