Problem/Motivation

After lots and lots of debugging, I discovered in #2869426-39: EntityResource should add _entity_access requirement to REST routes why _entity_create_access just wouldn't work for the REST module: because the REST module does not limit its routes that create entities to a single bundle. And some entity types check create access based on the bundle!

This is ONLY a DX problem. It does NOT have security implications.

Proposed resolution

Rather than doing

       // If we were unable to replace all placeholders, deny access.
       if (strpos($bundle, '{') !== FALSE) {
         return AccessResult::neutral();
       }

which is incredibly unhelpful, specify a reason!

       // If we were unable to replace all placeholders, deny access.
       if (strpos($bundle, '{') !== FALSE) {
         return AccessResult::neutral(sprintf("Could not find '%s' request argument, therefore cannot check create access.", $bundle));
       }

No more 🤔😡🙀!

Remaining tasks

None.

User interface changes

Helpful reason.

API changes

None.

Data model changes

None.

CommentFileSizeAuthor
#2 2973347-2.patch1.59 KBwim leers

Comments

Wim Leers created an issue. See original summary.

wim leers’s picture

Assigned: wim leers » Unassigned
Status: Active » Needs review
StatusFileSize
new1.59 KB
borisson_’s picture

Status: Needs review » Reviewed & tested by the community

This looks great, and has test coverage. The data provider also has tests for this usecase.

alexpott’s picture

Status: Reviewed & tested by the community » Fixed

Committed d6f7a9c and pushed to 8.6.x. Thanks!

  • alexpott committed d6f7a9c on 8.6.x
    Issue #2973347 by Wim Leers: EntityCreateAccessCheck should provide a...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.