Problem/Motivation

When checking access to update or edit an entity the operation to use for that is update. \Drupal\Tests\contact\Kernel\MessageEntityTest incorrectly uses edit instead.

Note that arguably using the wrong operation could in principle be seen as a bug, but since it is in test code and for a specific entity type (and not in a base test class, for example) it's really hard to argue that this is actually problematic in any concrete way, so marking as task.

Steps to reproduce

-

Proposed resolution

Change the test to use update instead. The test currently passes, because the operation is not explicitly checked (so in effect we could pass anything as the operation and the test would pass), but it's setting a wrong example for people looking at the code.

Remaining tasks

User interface changes

-

API changes

-

Data model changes

-

Release notes snippet

CommentFileSizeAuthor
#2 3260920-2.patch890 byteststoeckler

Comments

tstoeckler created an issue. See original summary.

tstoeckler’s picture

Status: Active » Needs review
StatusFileSize
new890 bytes
larowlan’s picture

Does this mean we're missing a test of sorts?

tstoeckler’s picture

Hmm... good question. So this is testing access control for contact messages, but contact messages don't implement any specific entity access (only for the create access). So this basically just tests the base access control logic that checks the admin permission - and the fact that the admin permission is set correctly on contact messages, which is why I think those tests were introduced at the time. So I think the tests are fine in terms of coverage. For context, this was introduced all the way back in #2427713: Contact module doesn't implement AccessControlHandler.

The thing is that the admin permission is checked regardless of the passed operation and we don't validate the operation in any other way either. So basically if you pass jump around (or whatever...) as the access operation it will grant access if you have the admin permission and it will deny access if you don't.

So I don't think there's anything missing in the test coverage and there's nothing functionally wrong. I think it does really make sense to change it, though, because update is the correct operation that is used all over core what (I presume) is meant to be tested in the test and, furthermore, edit is the correct operation for checking field access (i.e. $contactMessage->get('subject')->access('edit')) so this especially confusing and sets a bad example.

larowlan’s picture

Status: Needs review » Reviewed & tested by the community

Thanks for all that background, makes sense to me

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 2: 3260920-2.patch, failed testing. View results

tstoeckler’s picture

Status: Needs work » Reviewed & tested by the community

Random test failure (see #3267124: Temporarily skip failing tests) and then random checkout failure on the testbot. Back to RTBC now.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 2: 3260920-2.patch, failed testing. View results

tstoeckler’s picture

Status: Needs work » Reviewed & tested by the community

Another random failure: #3267754: AjaxTest is failing

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 2: 3260920-2.patch, failed testing. View results

tstoeckler’s picture

Status: Needs work » Reviewed & tested by the community
bradjones1’s picture

From #4:

this especially confusing and sets a bad example.

Yeah, it is... I found this issue trying to search for an issue that is basically "why do we have both 'edit' and 'update' for the U in CRUD?"

I guess I'll open one?

alexpott’s picture

Version: 9.4.x-dev » 9.3.x-dev
Status: Reviewed & tested by the community » Fixed

Committed and pushed 1922d82c4b to 10.0.x and a9d27d154a to 9.5.x and 04b84b6abb to 9.4.x and 2925ad48c7 to 9.3.x. Thanks!

Backported to 9..3x to keep the tests aligned.

  • alexpott committed 1922d82 on 10.0.x
    Issue #3260920 by tstoeckler: Contact's MessageEntityTest wrongly uses '...

  • alexpott committed a9d27d1 on 9.5.x
    Issue #3260920 by tstoeckler: Contact's MessageEntityTest wrongly uses '...

  • alexpott committed 04b84b6 on 9.4.x
    Issue #3260920 by tstoeckler: Contact's MessageEntityTest wrongly uses '...

  • alexpott committed 2925ad4 on 9.3.x
    Issue #3260920 by tstoeckler: Contact's MessageEntityTest wrongly uses '...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.