403 error for views.ajax route on Group related views (with AJAX enabled)

Facing the similar issue

Seeing this as well after upgrading from 8.3.9 to 8.5.3. Were you able to fix it?

hello,
i had the same issue, and after some debug i found the ajax call returns an access denied 403 because the access was not granted to the view (access to the views display i checked during the execution of the ajax call). digging deeper, i realize the permission to access my view were "group permission" -> "access node overview". There was a little notice bellow this special permission with a warning saying the permission only works if a "group" argument is inside the route.
because the ajax call has not such a "group" argument, the permission cannot not work properly (by construction, such a permisson do not support AJAX calls).
i do not know if you are in the same case, i post this explanation just in case , hope that helps.
Mikael

We too are experiencing this same issue.

Run into this issue too.

Workaround for me:
Removing Permission/Access for the View solved the problem.

But access check is required for me (to build a context). Currently I've no idea how to resolve this.

I ran into the same issue when using Views Infinite Scroll for a pager on a View based on Groups (with Contextual filter for a group from URL and AJAX enabled). The view has specific Group permission check (based on the group you're browsing). This check fails in AJAX calls.

I have created a patch that solves the issue for me (Drupal 8.5.5).

To make it work 100%, you'll also need to use this fix: https://www.drupal.org/project/drupal/issues/2866386 (specifically, https://www.drupal.org/project/drupal/issues/2866386#comment-12525337) or wait until it gets committed in Core :))

Otherwise, it will only work on the first pagination step (like it did in my case).

Please, test for other use cases.

Any update on this issue?

I was receiving the same error on a "views" with Access Group permission that I didn't want to touch, using ajax resulting the pager not working with access denied warning.
If you are having this issue on Drupal 8.6.4:
Here is my workaround to get the views pager to work.
1- apply https://www.drupal.org/project/drupal/issues/3021827#comment-12901850
2- Then apply the attached patch. I updated this patch based on #11

Patch #12 works on core 8.6.4

The patch in #11 does not applies on 8.x Here is the updated version. I have also made some improvements.

1. Instead of using unsafe $_POST I am using Symfony request component for retrieving the data.

The above patch doesn't work for me. I see 2 issues

- The value $_POST['view_path'] can only be obtained directly from $_POST and its null if obtained using 'Symfony request component'.
- The value $_POST['view_path'] is inclusive of site 'base_path' and so fails route matching if base path is not '/'.

I am attaching a patch against latest dev release of the module and it works fine for views infinite scroll using group permission.

EDIT:
I also had to use this core patch as 'load more' didn't work for me from second time
https://www.drupal.org/project/drupal/issues/2866386#comment-13158418

Patch #18 did not work for me (group_route_ajax_route-2942657-18.patch)

patch "-p4" --no-backup-if-mismatch -d "core" < "C:\Users\PLANNI~1\AppData\Local\Temp/5d80f9f882926.patch"
Executing command (CWD): patch "-p4" --no-backup-if-mismatch -d "core" < "C:\Users\PLANNI~1\AppData\Local\Temp/5d80f9f882926.patch"
can't find file to patch at input line 5
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff --git a/src/Context/GroupRouteContextTrait.php b/src/Context/GroupRouteContextTrait.php
|index 99e9a41..820404d 100644
|--- a/src/Context/GroupRouteContextTrait.php
|+++ b/src/Context/GroupRouteContextTrait.php
--------------------------
File to patch:
Skip this patch? [y]
Skipping patch.
1 out of 1 hunk ignored

   Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2019-06-27/group_route_ajax_route-2942657-18.patch

Patch #19 worked for me :).
Worked with plain pager and views_infinite_scroll.

Thanks!

Ajax broken again with 'group RC1'

Hi
Patch #19 worked for me with Group 8.x-1.3

Thanks community!

Patch #19 works like a charm ! Thanks

Patch #19 worked for me with Group 8.x-1.4

Raised to major because Group related views which using AJAX are not working.

$view_route_match = \Drupal::service('router')->match($view_path);

That calls AccessAwareRouter which checks access to the route. I don't think it is needed because we just want to get the group parameter.
Also it conflicts with #2815971: More contexts needed when Group permission plugin is used. Access control and Group route context call each other which creates infinite loop.
The attached patch relies on router.no_access_checks router instead.

Changed to 2.x-dev since 1.x is security fix only. This still applies as-is to 2.x, and it's still necessary to fix the issue.

Bug still exists in Group 3.2.0. #27 and #19 apply cleanly, but do not resolve the problem. Removing the group permission from the view's access control setting does, but of course that access restriction is there for a reason!

Patch in #19 still has to be applied in Group 8.x-1.6.

#27 doesn't work with Drupal ^10.1 when a view's ajax is a GET. Here's an update to handle older core versions with POST and newer ones with GET. Manually tested with both Drupal 9.5 and Drupal 10.1, both with and without a base path, and with and without valid access. This is just begging for automated tests.

@david.muffley in #31: can't you use $_REQUEST in stead of the switch between $_GET and $_POST?

Refactored the last patch to make it Drupal 10 compatible.

Thanks all and thanks @HitchShock. #33 works for me in Drupal 10.2.3 and Group 1.6.0.

Adding some pieces of the error that is thrown by this issue so hopefully folks find this easier:

access denied Warning Path: /views/ajax?_wrapper_format=drupal_ajax
Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: in Drupal\views\Controller\ViewAjaxController->ajaxView() (line 220 of /docroot/core/modules/views/src/Controller/ViewAjaxController.php)

@HitchShock applied patch #33 in Drupal 10.2.4 but not working for me, just scrolls to the top of the page.

I had a similar issue with exposed filters (without Views Infinite Scroll) in D10.
Patch #33 by @HitchShock solves my issue. Not sure about VIS though.

Added validation when Group view is attached to a node or any other page

I've turned this into an MR with the idea to replace the call to \Drupal::service() and to $_REQUEST with proper function calls. While that works for the router, it doesn't for the request parameter. I wasn't able to figure out why and commented that out in line 124. Maybe somebody knows why this isn't working?

@jurgenhaas - i found that the 'view_path', along with other parameters used by ajax, have been stripped by the time you can get them via dependency injection of the symfony request stack.

See: core/modules/views/src/Controller/ViewAjaxController.php
in method "ajaxView"

      foreach (self::FILTERED_QUERY_PARAMETERS as $key) {
        $request->query->remove($key);
        $request->request->remove($key);
      }

(one of the FILTERED_QUERY_PARAMETERS is of course "view_path")

I adjusted your MR to remove the request property on the class, and the commented code.

This works for us, test steps to follow.

Testing Steps

Create a view with a group relationship
Format the view as a table
Click "sortable" on one or more of the field in the settings
Update the "Access" to be "Group Permission", then set that permission
Use ajax

Verify when logged in as a member of a group with the correct permissions that the click sorting works with ajax enabled