Problem/Motivation
DefaultSelection::validateTargetBundles() converts an empty target bundle selection from [] to NULL, meaning that all bundles are referenceable.
For entity types with bundles, the configuration form however requires at least one target bundle to be selected. Neither [] nor NULL is accepted. As noted in #20, the conversion therefore cannot enable a successful form submission without a selected bundle.
As for the background requested in #9, the #required flag was introduced per #1953444: Make 'target bundles' required on the Entity reference instance settings form. Its purpose was to prevent site builders from overlooking the bundle selection, thereby selecting all bundles by default, even future ones.
Even worse, a semantic that turns [] (no bundles allowed) into NULL (all bundles allowed) is inherently problematic, whenever the last previously selected bundle happens to be deleted from the entity type, as described in #3031637-17: Entity reference: allow specifiying that every bundle is allowed.
For entity types with bundles, the form validator validateTargetBundles() should therefore be deprecated and subsequently removed. For bundleless entity types, the form should supply NULL directly.
This issue does aim to change the handler's default configuration, the bundle selection's #required flag, or the supported NULL/[] semantics.
Steps to reproduce
- Inspect
DefaultSelection::buildConfigurationForm(). - For entity types with bundles, observe that
target_bundlesis#required. - For bundleless entity types, observe that the form supplies
[]through a value element. - Observe that both cases register
validateTargetBundles(), which converts[]toNULL.
Proposed resolution
- Set the form element's value directly to
NULLfor bundleless entity types. - Remove the registration of
validateTargetBundles(). - Deprecate the public static method for backward compatibility.
Remaining tasks
Review.
User interface changes
None. Target bundle selection remains #required for entity types with bundles.
API changes
None. The public callback remains available, and programmatic configuration continues to support both NULL and [] for target_bundles.
Data model changes
None. The resulting saved configuration remains unchanged.
Original Report
For security reasons, we took the explicit design decision that if no target bundle is configured, we shouldn't fall back to allowing all bundles.
However, DefaultSelection::validateConfigurationForm() still contains:
// If no checkboxes were checked for 'target_bundles', store NULL ("all
// bundles are referenceable") rather than empty array ("no bundle is
// referenceable" - typically happens when all referenceable bundles have
// been deleted).
if ($form_state->getValue(['settings', 'handler_settings', 'target_bundles']) === []) {
$form_state->setValue(['settings', 'handler_settings', 'target_bundles'], NULL);
}
This is not a big problem, as the 'target_bundles' form element is #required anyway, so the case that an empty array is in the values to be validated may never occur. Even more, this means these lines should not be there.
This issue was split off #2429699: Add Views EntityReference filter to be available for all entity reference fields: Add Views EntityReference filter to be available for all entity reference fields.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | dont_allow_all_bundles-3061180-07.patch | 1.25 KB | kunalgautam |
| #2 | default_selection_empty_target_bundles_3061180-2.patch | 1.25 KB | pancho |
Issue fork drupal-3061180
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
panchoComment #6
kunalgautam commentedComment #7
kunalgautam commentedPatch for Drupal 9.1
Comment #8
kunalgautam commentedComment #9
joachim commented> For security reasons, we took the explicit design decision that if no target bundle is configured, we shouldn't fall back to allowing all bundles.
Could the link to the issue for that change be added to the issue summary please?
Comment #15
smustgrave commentedPer #9. I can't find it but fairly positive there is a newer ticket for this too.
Comment #17
smustgrave commented#1978714: Entity reference doesn't update its field settings when referenced entity bundles are deleted was the issue this code was added to, but don't see anything in that ticket about this being a security issue. So can the issue where this was a security issue? If no follow up I say we close out.
Comment #18
joachim commentedThe documentation around the NULL/[] difference for target bundles was updated in another issue about a year ago. IIRC it got fixed, so there should be an explanation in code now.
Comment #19
smustgrave commentedSo should this be closed now? or rescoped.
Comment #20
joachim commentedNeeds a rescope.
but:
So AFAICT you can't submit the form with nothing checked anyway, and thus the whole of that validation callback can be removed.
Comment #22
panchoComment #23
panchoComment #25
panchoFor BC reasons, I chose to deprecate the validator rather than removing it altogether.
However I added a warning against use in contrib and custom code, as it's outright wrong, not just superfluous.
Ready for review, I guess.
Comment #26
needs-review-queue-bot commentedThe Needs Review Queue Bot tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".
This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.
Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.