Validate widget entity type and bundles

I'm also experiencing this issue. Any solution yet?

same problem here

Any thoughts!

I migrated to Core Media, and did not alter the config generated during the migration. I have the config as it was generated, and lots of content already, so changing the field type is not an option. Any help would be appreciated!

This is still an issue with core Media and Entity Browser.

Drupal 8.6.1
Entity Browser 8x-2.0
Inline Entity Form 8x-1.0-rc1
Paragraphs 8x-1.3

Unable to upload/replace image using Entity Browser. Clicking on upload does in fact upload the image to sites/default/files/media but doesn't display as uploaded and results instead in "The entity must be of type media." error.

The file displays in the Files content overview section but doesn't register as Media content. The file also shows that it is not used in 0 places.

When switched from Entity Browser widget to Inline entity form - simple/advanced the image is correctly uploaded and displayed.

Similar and unresolved issues:

https://www.drupal.org/project/entity_browser/issues/2822354 - there is a suggested solution to make sure that the field is a Media reference field but I am using entity reference > media > image for the field and still get the "..must be of type.." error
https://www.drupal.org/project/entity_browser/issues/2685029
https://www.drupal.org/project/entity_browser/issues/2948839

------EDIT

I've decide to move to Media Library which is currently experimental in Drupal 8.6.1 core. It seems to be functioning well for selecting media images for reuse and for uploading.

You need to add a reference field instead.

Reference group => Other
Next step: Content group => Media
Next step: in the field setup you can pick one of your created media bundles

removed comment, I realized it wasn't relevant.

Changing field type is not a solution nor a workaround for sites with uploaded medias. Any ideas?

I believe the bug here is user error. You must use the "Upload" widget for file/image fields and the "Upload as media items" widget for media entity fields.

In order to recreate the bug, I had to use the "Upload as media items" widget on an image field. I don't think this is happening with media entity reference fields.

Feel free to reopen it if you are seeing this using a media entity reference field.

I opened another issue, which is that entity browsers should have an assigned entity type. That way, you could only show relevant widgets for the entity type on the widgets form, and prevent entity browsers for other entity types from showing as options on field widgets.

#3041830: Entity Browsers should be assigned an entity type

Good point, "cannot reproduce" was the wrong designation. We can leave this one open too.

Here's an initial patch that will replace the widget with a warning if wrong entity type widget used on field. Implemented on Upload, MediaImageUpload and View widget.

Fixing test and adding entity check and bundle check to EntityForm widget.

Still needs to be done:

• copy validation over to field widget settings validation When field widget settings are updated, the validation should check each widget against the target entity type of the field set form error on entity browser field if the mismatch.
• Add test coverage

Adding validation on the field widget settings form. Since I have another patch that has added some unrelated validation, I worked off a combined patch (with 2807873 #38) . I'm adding a combined patch to test against testbot, and patch that has just the changes for this issue, which could be committed after that one is committed.

- Adds interface WidgetEntityInfoInterface with two methods, ::getTargetEntityTypeId and ::getTargetBundles. I added it to a new interface to avoid breaking BC.
- Adds interface to WidgetBase with default implementations. This way all widgets that extend this class, which should be all of them have default implementations that return NULL or an empty array (for the getTargetBundles()) method. Since the validation checks if these are set before validating, so that contrib modules that extend WidgetBase but haven't implemented the two methods will just not be validated. After this is merged we can create tickets on those other modules issue queues to implement the two methods in their widget classes.
- Updates all four widgets included with module to implement these two methods.
- Add validation to the field widget when settings updated to iterate through the widgets and if the widget has methods that return entity type or bundles, validate them against the field widget settings and set form errors if there is a mismatch.

There are some nice features, such as if a view implements the 'type' filter it will validate that the bundles set in the type filter are within the allowed bundles on the field. This should stop an annoying problem where entity browser allows you to use a view that selects bundles that aren't allowed on field and you get a vague error. See #3035741: Vague error on submit in field widget when invalid item selected.

Still to do:
- add test coverage

Adding test coverage for field widget settings form.

It could still use more test coverage. This covers the functionality, but only tests the view widget. It would be good to test the upload, media upload and entity form widgets.

Requeuing test. It was a random failure.

- Adds test coverage for field widget settings form validation for upload, media upload and entity form.
- Adds schema for MediaUploadWidget, as it was missing, and trying to add it to a test was giving me schema errors. When adding it, I noticed that my configs had been exported with strings for the multiple field, so I changed that one to be a string, so as not to break BC.
- Fixes a bug in my previous patches where the target entity was incorrectly sourced in the validation method.

There is still some test coverage to do. There should be validation for all four widgets when they are misconfigured, it shows the Drupal warning instead of loading the form.

Fixing interdiff on the last comment. One of the branches didn't have latest commit.

Reroll of patch #24 (as I hadn't merged in changed to one of the branches, so it shows the last commit as part of patch.

- Adds test coverage for all four widgets when misconfigured (which can happen despite field widget validation if they change entity browser after the fact).
- Move similar functionality into widget base, adds new interface for the validation.

To do:
Mostly review. I ran out of time tonight so I might need to fix the tests a little. There might be some cleanup, coding standards. Will look at it with fresh eyes later.

Fixing tests.

Now that 2807873 is merged, please review the individual patches, such as

https://www.drupal.org/files/issues/2019-03-25/entity-browser-widget-ent...

Ignore the combined patches.

#2807873: entity browser crashes: 'Used entity browser selection display does not support preselection'

Random failures on #32, requeuing tests.

Reroll

reroll

I went through and tested, and unable to see the error post applying patch from #38.

Reroll, as patch wasn't applying any more.

This patches with the latest dev from 4/20, as well as removes the error.

An issue summary update would be very helpful, explain what exactly the problem is and what the patch is doing. If I understand this correctly, this is basically just about validating which widget can be used in the current context, but it is a pretty massive patch.

Since it's such a massive patch, I broke it up so it can reviewed in parts:

• part 1: changes to widgets to support exposing entity type and entity bundle
• part 2: validation added to field widgets that come with the module, entity_browser_entity_reference and entity_browser_file on the field widget config form.
• part 3: changes to widget getForm methods to validate based on the changes in part 1. If a widget doesn't implement it's own validation as in this part 3, the validation doesn't happen. This means contrib modules that implement this will need to add some validation to their getForm methods if they would like to get this validation on their widgets.
• part 4: add schema for media_image_upload, it was missing and I received a schema error adding this to an entity browser for the tests. We could possibly avoid adding this by changing the way the tests work.
• part 5: changes to EntityBrowserTest. There was a validation problem where an entity browser with a file entity widget was being used on a node field in the test. I update the test to use a different field that isn't misconfigured.
• part 6: adds a bunch of validation tests to cover the widgets shipping with the module.
• part 7: new configs to simplify the tests, so I don't need to write out the creation of fields and field widget configs on each test.

We could possibly break this into 3 patches, if that helps:

1. Add validation on field widget config form on entity form settings page.
2. Add validation on widgets within the entity browser when using a field widget, entity_embed or inline entity form widget.
3. Add missing schema for media_image_upload.

They're all interconnected and I feel the changes are relatively low risk, so I think as long it's reviewable, one large patch isn't unworkable.

Same as #40, just reposting.

Great work, this patch is working fine and really helpful.

While working with the patch, I was wondering whether it is possible to expose only valid entity browsers inside the configuration form. This would make it even easier to configure the form display.

As this patch is already that huge, I don't want to extend it. Nevertheless I tried to implement this functionality and came up with this patch

--- a/src/Plugin/Field/FieldWidget/EntityReferenceBrowserWidget.php
+++ b/src/Plugin/Field/FieldWidget/EntityReferenceBrowserWidget.php
@@ -153,9 +153,16 @@ class EntityReferenceBrowserWidget extends WidgetBase implements ContainerFactor
     $element = parent::settingsForm($form, $form_state);
 
     $browsers = [];
+    $target_entity_type = $this->getFieldSetting('target_type');
     /** @var \Drupal\entity_browser\EntityBrowserInterface $browser */
     foreach ($this->entityTypeManager->getStorage('entity_browser')->loadMultiple() as $browser) {
-      $browsers[$browser->id()] = $browser->label();
+      $widgets = $browser->getWidgets();
+      foreach ($widgets as $widget) {
+        if ( $widget->getTargetEntityTypeId() == $target_entity_type) {
+          $browsers[$browser->id()] = $browser->label();
+          continue;
+        }
+      }
     }
 
     $element['entity_browser'] = [

which might be the base for a possible follow-up?

@mmbk, thanks for the review. I considered limiting the entity browsers in the select, but I was concerned we would get tickets from users concerned that entity browsers are missing from the select. It's too bad drupal core doesn't support greying out select elements. I think we should make a separate issue for this, as a follow up. Perhaps we could add a note under the select. "The following entity browsers are not available to select because they are not applicable to this field widget, @list_of_browsers". We'd also have to handle the case where there are no available entity browsers.

Reroll

Confirmed RTBC - Thanks

Tested that this still applies against current head. 👍

It will need a reroll against 8.x-1.x branch, as there is a test dependency on drupal:media (>= 8.4)

So for fields that were set up as image (migrated from D7) there's not much hope for ever converting those fields to entity-browser/media, is there?

Maybe we could have some twig trickery where we have a migrated image field AND a new media entity field. If the new media entity field is filled in then the twig just skips rendering the old field. If the new field doesn't exist and the old migrated one does, it shows the old one.

I suppose we could even hide input for the old migrated field so that editors aren't confused by it, if it had content from the migration great, if not nobody would ever know it's even still there.

Or put another way:

field_featured_image_migrated old image field migrated from d7

field_featured_image_media_entity new image field that is entity reference that goes to our media library

If the second one exists then rendering of the first one is ignored, allowing editors to change images for migrated content as they need to (but really they're adding to the new field and the twig is skipping the old one). Maybe a convoluted solution but seems like it would work...

I was also thinking how to improve the widget's appearance and found that WidgetBase has access() method. Maybe as another approach it would be better to pass widget_context from form_state (['entity_browser', 'widget_context']) to this access method and then each instance of the widget can decide if it is allowed to be shown or not according to field settings the browser is used in?

Widget Context has 'target_bundles', 'target_entity_type' and 'cardinality'. If widget has restriction by type or bundle it will react on that and restrict access to widget, what do you think?

This will definitely bring some breaking changes to WidgetInterface that doesn't have any arguments for access method.

I checked it a bit more and found that it is also possible to not change the access() method definition, because the widget context can be retrieved from entity_browser.selection_storage the same way it is done in src/Plugin/views/filter/ContextualBundle.php starting from line 89 (I am talking about version 2.x)

Another advantage of having this in access() method - when having multiple tabs in the form - the tabs, that should not be there, will not be there, instead of having the message from the patch.

Actually I did the override of the plugin class and extend the access method and it works pretty nice. Maybe this idea could be a part of the existing approved patch?

@a.dmitriiev Would you mind sharing your solution? How did you manage to use access method?
I really like the idea of using access() method. It looks much cleaner and natural.

First I have overriden the widgets:

/**
 * Implements hook_entity_browser_widget_info_alter().
 */
function my_module_entity_browser_widget_info_alter(array &$widgets) {
  $overrides = [
    'dropzonejs_media_entity_inline_entity_form' => '\Drupal\my_module\Plugin\EntityBrowser\Widget\InlineEntityFormMediaWidgetOverride',
    'dropzonejs_media_entity' => '\Drupal\my_module\Plugin\EntityBrowser\Widget\MediaEntityDropzoneJsEbWidgetOverride',
    'entity_form' => '\Drupal\my_module\Plugin\EntityBrowser\Widget\EntityFormOverride'
  ];
  foreach ($overrides as $plugin_id => $class) {
    if (!empty($widgets[$plugin_id])) {
      $widgets[$plugin_id]['class'] = $class;
    }
  }
}

And then extended the widget classes from entity browser module with the classes listed in the hook above.

EntityFormOverride:

namespace Drupal\my_module\Plugin\EntityBrowser\Widget;


use Drupal\Core\Access\AccessResult;
use Drupal\entity_browser_entity_form\Plugin\EntityBrowser\Widget\EntityForm;
use Symfony\Component\DependencyInjection\ContainerInterface;

class EntityFormOverride extends EntityForm {

  use WidgetContextTrait;

  /**
   * @param \Symfony\Component\DependencyInjection\ContainerInterface $container
   * @param array $configuration
   * @param string $plugin_id
   * @param mixed $plugin_definition
   *
   * @return \Drupal\Core\Plugin\ContainerFactoryPluginInterface|\Drupal\entity_browser\WidgetBase|\Drupal\entity_browser_entity_form\Plugin\EntityBrowser\Widget\EntityForm
   */
  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
    $widget = parent::create($container, $configuration, $plugin_id, $plugin_definition);
    $widget->setRequestStack($container->get('request_stack'));
    $widget->setStorage($container->get('entity_browser.selection_storage'));
    return $widget;
  }

  /**
   * {@inheritdoc}
   */
  protected function contextAccess() {
    $widget_context = $this->getWidgetContext();
    if (!empty($widget_context)) {
      if ($widget_context['target_entity_type'] !== $this->configuration['entity_type'] || !in_array($this->configuration['bundle'], $widget_context['target_bundles'])) {
        return AccessResult::forbidden('This field does not support ' . $this->configuration['entity_type'] . ' of type ' . $this->configuration['bundle']);
      }
    }
    return AccessResult::allowed();
  }

  /**
   * Overrides access to widget.
   *
   * @return \Drupal\Core\Access\AccessResultInterface
   */
  public function access() {
    if (parent::access()) {
      return $this->contextAccess();
    }
  }
}

InlineEntityFormMediaWidgetOverride:

namespace Drupal\my_module\Plugin\EntityBrowser\Widget;


use Drupal\Core\Access\AccessResult;
use Drupal\dropzonejs_eb_widget\Plugin\EntityBrowser\Widget\InlineEntityFormMediaWidget;
use Symfony\Component\DependencyInjection\ContainerInterface;

/**
 * Class InlineEntityFormMediaWidgetOverride
 *
 * @package Drupal\my_module\Plugin\EntityBrowser\Widget
 */
class InlineEntityFormMediaWidgetOverride extends InlineEntityFormMediaWidget {

  use WidgetContextTrait;

  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
    $widget = parent::create($container, $configuration, $plugin_id, $plugin_definition);
    $widget->setRequestStack($container->get('request_stack'));
    $widget->setStorage($container->get('entity_browser.selection_storage'));
    return $widget;
  }

  /**
   * {@inheritdoc}
   */
  protected function contextAccess() {
    $widget_context = $this->getWidgetContext();
    if (!empty($widget_context)) {
      if ($widget_context['target_entity_type'] !== 'media' || !in_array($this->configuration['media_type'], $widget_context['target_bundles'])) {
        return AccessResult::forbidden('This field does not support media of type ' . $this->configuration['media_type']);
      }
    }
    return AccessResult::allowed();
  }

  /**
   * Overrides access to widget.
   *
   * @return \Drupal\Core\Access\AccessResultInterface
   */
  public function access() {
    if (parent::access()) {
      return $this->contextAccess();
    }
  }

}

MediaEntityDropzoneJsEbWidgetOverride:

namespace Drupal\my_module\Plugin\EntityBrowser\Widget;


use Drupal\Core\Access\AccessResult;
use Drupal\dropzonejs_eb_widget\Plugin\EntityBrowser\Widget\MediaEntityDropzoneJsEbWidget;
use Symfony\Component\DependencyInjection\ContainerInterface;

/**
 * Class MediaEntityDropzoneJsEbWidgetOverride
 *
 * @package Drupal\my_module\Plugin\EntityBrowser\Widget
 */
class MediaEntityDropzoneJsEbWidgetOverride extends MediaEntityDropzoneJsEbWidget {

  use WidgetContextTrait;

  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
    $widget = parent::create($container, $configuration, $plugin_id, $plugin_definition);
    $widget->setRequestStack($container->get('request_stack'));
    $widget->setStorage($container->get('entity_browser.selection_storage'));
    return $widget;
  }

  /**
   * {@inheritdoc}
   */
  protected function contextAccess() {
    $widget_context = $this->getWidgetContext();
    if (!empty($widget_context)) {
      if ($widget_context['target_entity_type'] != 'media' || !in_array($this->configuration['media_type'], $widget_context['target_bundles'])) {
        return AccessResult::forbidden('This field does not support media of type ' . $this->configuration['media_type']);
      }
    }
    return AccessResult::allowed();
  }

  /**
   * Overrides access to widget.
   *
   * @return \Drupal\Core\Access\AccessResultInterface
   */
  public function access() {
    if (parent::access()) {
      return $this->contextAccess();
    }
  }

}

WidgetContextTrait:

namespace Drupal\my_module\Plugin\EntityBrowser\Widget;


use Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface;
use Symfony\Component\HttpFoundation\RequestStack;

trait WidgetContextTrait {

  /**
   * A request stack symfony instance.
   *
   * @var \Symfony\Component\HttpFoundation\RequestStack
   */
  protected $requestStack;

  /**
   * The entity browser selection storage.
   *
   * @var \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface
   */
  protected $selectionStorage;

  /**
   * Sets Request Stack dependency injection.
   *
   * @param \Symfony\Component\HttpFoundation\RequestStack $requestStack
   */
  protected function setRequestStack(RequestStack $requestStack) {
    $this->requestStack = $requestStack;
  }

  /**
   * Sets storage dependency injection.
   *
   * @param \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface $storage
   */
  protected function setStorage(KeyValueStoreExpirableInterface $storage) {
    $this->selectionStorage = $storage;
  }

  /**
   * Gets widget context.
   *
   * @return array
   */
  protected function getWidgetContext() {
    // Pull $this->value from entity browser storage.
    $current_request = $this->requestStack->getCurrentRequest();
    if ($current_request->query->has('uuid')) {
      $uuid = $current_request->query->get('uuid');
      if ($storage = $this->selectionStorage->get($uuid)) {
        if (isset($storage['widget_context'])) {
          return $storage['widget_context'];
        }
      }
    }
    return [];
  }

  /**
   * Checks context access.
   *
   * @return \Drupal\Core\Access\AccessResultInterface
   *   The access result.
   */
  abstract protected function contextAccess();

}

And now I have only 1 entity browser that has widgets for all media types, but the tabs are displayed only when they are allowed to be displayed.

@a.dmitriiev Nice approach. I ended up patching the access() methods to expose a hook that I can use in other modules.
Then I used my custom module to add logic about widget context, and now I also have a single browser that respects field settings :)

I also like the use of WidgetContextTrait.

Anyway - I think this approach should be considered for this issue as it feels much more user friendly and less misleading then throwing errors and warnings to users.

Patch does not apply anymore to latest release https://www.drupal.org/project/entity_browser/releases/8.x-2.10.

Re-roll against 2.x

Fix on the previous re-roll as schema was already there.

@hanoii I'm getting this error in drupal 10.2.6 and using paragraphs with an image field with Entity browser widget and use media directories

TypeError: file_validate(): Argument #1 ($file) must be of type Drupal\file\FileInterface, Drupal\media\Entity\Media given, called in /var/www/example.com/modules/contrib/entity_browser/src/Plugin/EntityBrowser/WidgetValidation/File.php on line 31 in file_validate() (line 101 of core/modules/file/file.module).

for some reason the patch doesn't do anything in my case

2930677-n68.patch in #68 is not working for me either.

Patch on 2.15.0

Claude Code says:

Issues found:

1. Bug: MediaImageUpload::getForm() breaks the media_type validation. The new if (!empty($widget_context)) wraps the early return, and the existing media_type check is changed to elseif. This means when widget_context IS set but the entity type matches (normal case), the elseif doesn't execute, and media_type validation is completely skipped. The user could have a NULL/invalid media type and the code would fall through without catching it. The existing if for media_type should remain independent, not be chained as elseif.
2. Bug: View widget alter hook receives wrong object. The original code had $view as a ViewExecutable. The refactored code splits it into $view (config entity) and $view_executable, but the alter hook call still passes $view: $this->moduleHandler->alter('entity_browser_view_executable', $view, ...) This is a breaking change — hook implementations expecting a ViewExecutable now receive a View config entity. Should be $view_executable.
3. Unused variable in View widget getForm(). $entity_browser is loaded but never referenced — dead code / wasted query.
4. View loaded 3 times. getForm() loads the view, then getTargetEntityTypeId() and getTargetBundles() each load it again independently. The view object from getForm() should be reused or the results cached.
5. Missing $defaultTheme in WidgetFormValidationTest. All other WebDriverTestBase tests in the module set protected $defaultTheme = 'stark';. This will cause a deprecation warning or test failure on newer Drupal.
6. Missing use statements in EntityReferenceBrowserWidget. The validateSettingsForm references WidgetEntityInfoInterface and FieldConfig, but neither is imported. This would be a fatal error.
7. getTargetBundles() in View widget is fragile but acceptable. It reads $filters['type']['value'] which assumes a specific filter name. Returns [] for unrecognized configurations (fails open), so it won't cause false positives — just missed validations for non-standard views.
8. Bundle validation logic inconsistency. In View widget's getForm(), the bundle check iterates $widget_target_bundles and returns an error if ANY widget bundle is missing from $widget_context['target_bundles']. But this means a view showing articles AND pages would fail validation on a field targeting only articles — even though the view includes articles. Depending on intent, you might want to check for zero overlap rather than requiring all widget bundles to match.
9. Test duplication. testEntityBrowserWidgetContext, testContextualBundle, and testContextualBundleExposed all have identical field setup blocks (creating field_galaxy with the same config). This could use a shared helper like WidgetFormValidationTest::setUpField().

Summary: The feature concept is valuable — catching entity type mismatches at config time saves users from confusing runtime failures. But the patch has two clear bugs (#1 media_type validation bypass, #2 alter hook regression) and a fatal error (#6 missing imports) that need fixing before merge. The performance concern (#4) is secondary but worth addressing.

This has merge conflicts.

I've rebased !142 onto upstream