Problem/Motivation

After updating drupal/book to 3.0.3, a block using the Book visibility condition can trigger a fatal error when it is evaluated on a route with a normal node that is not a Book-enabled bundle.

The condition plugin calls getBook() unconditionally:

web/modules/contrib/book/src/Plugin/Condition/Book.php

$node = $this->getContextValue('node');
$book = $node->getBook();

But getBook() only exists on nodes using the Book bundle class (Drupal\book\Entity\Node\Book), not on a normal core Drupal\node\Entity\Node.

That means a block with Book visibility configured can WSOD on unrelated node routes.

Error

Error: Call to undefined method Drupal\node\Entity\Node::getBook() in Drupal\book\Plugin\Condition\Book->evaluate()

Steps to reproduce

  1. Enable book.
  2. Configure Book so only one content type is Book-enabled.
  3. Place a block with the Book visibility condition enabled.
  4. Visit a route with a node from a non-Book content type, for example /node/123.
  5. The block visibility condition is evaluated and the page fatals.

Expected result

The Book visibility condition should return FALSE for nodes that are not Book-enabled.

Actual result

The condition fatals because it assumes all routed node entities implement getBook().

Why this is a bug

The Book module already distinguishes between Book-enabled node bundles and normal node bundles using BookInterface / the Book bundle class. The visibility condition should do the same. A block visibility condition should fail closed, not take down the page.

Proposed fix

Guard evaluate() with an interface check before calling getBook():

if (!$node instanceof BookInterface) {
  return FALSE;
}

Issue fork book-3586802

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

jcmartinez created an issue. See original summary.

aaronpinero’s picture

I used the plain diff of the merge request to patch the module and this fixed the error for me.

  • jcmartinez committed efeeeb8d on 3.0.x
    Issue #3586802: Guard Book condition against non-book node bundles
    
smustgrave’s picture

Status: Active » Fixed

Fine with this change, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.