Problem/Motivation
Having the following error after finishing the installation.
Error message
Entity queries must explicitly set whether the query should be access checked or not. See Drupal\Core\Entity\Query\QueryInterface::accessCheck().
Proposed resolution
Have queries over entities changed in the Diff module
With basic accessCheck(TRUE) or pass the needed access check for admins or selected user roles and permissions.
Access checking must be explicitly specified on content entity queries
#2785449: It's too easy to write entity queries with access checks that must not have them
BEFORE
// This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
->condition('type', 'article')
->execute();
// This also gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
->accessCheck(TRUE)
->condition('type', 'article')
->execute();
// This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
->accessCheck(FALSE)
->condition('type', 'article')
->execute();
AFTER
// This will trigger a deprecation error.
$ids = \Drupal::entityQuery('node')
->condition('type', 'article')
->execute();
// Unchanged: This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
->accessCheck(TRUE)
->condition('type', 'article')
->execute();
// Unchanged: This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
->accessCheck(FALSE)
->condition('type', 'article')
->execute();
Remaining tasks
- File an issue
- Patch/MR
- Test
- Review
User interface changes
API changes
Data model changes
Comments
Comment #2
rajab natshahComment #4
rajab natshahComment #5
rajab natshahComment #6
rajab natshahComment #8
heddnI posted on the MR, but I don't think this change is strictly needed. Config queries always operate with no security. If my understanding here is in error, feel to re-open with an explanation.