Problem/Motivation

The entity query on the settings form is missing an access check:

 ------ ----------------------------------------------------------------------- 
  Line   src/Form/RRSSBSettingsForm.php                                         
 ------ ----------------------------------------------------------------------- 
  244    Relying on entity queries to check access by default is deprecated in  
         drupal:9.2.0 and an error will be thrown from drupal:10.0.0. Call      
         \Drupal\Core\Entity\Query\QueryInterface::accessCheck() with TRUE or   
         FALSE to specify whether access should be checked.                     
         💡 See https://www.drupal.org/node/3201242                             
 ------ -------------------------------------------------------

Issue fork rrssb-3453055

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !15

ptmkenny’s picture

ptmkenny commented
Status: Active » Needs review
adamps’s picture

adamps commented

Thanks.

It's strange - the report says "and an error will be thrown from drupal:10.0.0." however I just tested on D10 and there was no error. Also everywhere I checked in Core doesn't have the call to accessCheck.

After much head-scratching I believe that the error report is wrong. The link change report states (not obviously, but it's there): "This change doesn't apply to config entities." Which makes sense because they have no access checking. Perhaps you are running an old version of phpstan, or it's a phpstan bug?

ptmkenny’s picture

ptmkenny commented

Hmm, that is interesting. Yes, in theory these errors should be easy to find because they should result in a WSOD.

It's not a phpstan version problem, as this error can be seen in the GitLab CI report on the project page: https://git.drupalcode.org/project/rrssb/-/jobs/1805469

When I get some time I'll try to dig into how the drupal phpstan extension is doing this analysis; it very well could be a false positive.

adamps’s picture

adamps commented
Status: Needs review » Closed (works as designed)

ptmkenny closed merge request !15