Problem/Motivation

Entity queries must explicitly set whether the query should be access checked or not. See Drupal\Core\Entity\Query\QueryInterface::accessCheck().

Steps to reproduce

Use the 2.0.0 version of the module with Drupal 10. Go to any FO page (node or other content).

Proposed resolution

Add $query->accessCheck() in \Drupal\orejime\Services\OrejimeManager::getAllServices().
Add $query->accessCheck() in \Drupal\orejime\Form\OrejimeForm::nameAlreadyUsed().

Comments

MBidinger created an issue. See original summary.

mbidinger’s picture

mbidinger commented
Issue summary: View changes

  • Fabsgugu committed f0e147f7 on 2.0.x 
    Issue #3326289: D10 compatibility - query access check
fabsgugu’s picture

fabsgugu commented
Status: Active » Fixed

I had seen this while analyzing one of my sites for Drupal 10.
Thanks for the issue !

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

davidiio’s picture

davidiio commented

Sorry for re-opening this issue but I think an ->accessCheck() is still missing in /src/Form/OrejimeSettingsForm.php, around line 387.
It prevents from opening de module configuration page.

fabsgugu’s picture

fabsgugu commented

Thanks,
I corrected.

jlarvers’s picture

jlarvers commented

Same problem with D 10.0.5 with version 2.0.0. No access to Drupal after module activation. Unable to remove module next: orejime: There is content for entity type: Orejime. <a href="/admin/modules/uninstall/entity/orejime_service">Remove orejime Entities</a>.
It's good with version 2.0.x-dev