Problem/Motivation

Having the following error after finishing the installation.

Error message
Entity queries must explicitly set whether the query should be access checked or not. See Drupal\Core\Entity\Query\QueryInterface::accessCheck().

Proposed resolution

Have queries over entities changed in the Diff module
With basic accessCheck(TRUE) or pass the needed access check for admins or selected user roles and permissions.

Access checking must be explicitly specified on content entity queries
#2785449: It's too easy to write entity queries with access checks that must not have them

BEFORE

// This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->condition('type', 'article')
  ->execute();

// This also gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(TRUE)
  ->condition('type', 'article')
  ->execute();

// This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(FALSE)
  ->condition('type', 'article')
  ->execute();

AFTER

// This will trigger a deprecation error.
$ids = \Drupal::entityQuery('node')
  ->condition('type', 'article')
  ->execute();

// Unchanged: This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(TRUE)
  ->condition('type', 'article')
  ->execute();

// Unchanged: This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(FALSE)
  ->condition('type', 'article')
  ->execute();

Remaining tasks

  • File an issue
  • Patch/MR
  • Test
  • Review

User interface changes

  • N/A

API changes

  • N/A

Data model changes

  • N/A
CommentFileSizeAuthor
#2 3348096-2.patch596 bytesrajab natshah

Issue fork diff-3348096

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Rajab Natshah created an issue. See original summary.

rajab natshah’s picture

StatusFileSize
new596 bytes

rajab natshah’s picture

Assigned: rajab natshah » Unassigned
Status: Active » Needs review
rajab natshah’s picture

rajab natshah’s picture

Priority: Normal » Major

heddn made their first commit to this issue’s fork.

heddn’s picture

Status: Needs review » Closed (won't fix)

I posted on the MR, but I don't think this change is strictly needed. Config queries always operate with no security. If my understanding here is in error, feel to re-open with an explanation.