Problem/Motivation

tca_entity_access() fires for every entity load but does not check that \Drupal::request()->query->get('tca') returns a token.

As a result, it fires return \Drupal::service('tca.tca_access_check')->access($entity, substr($user_token, 0, 255), $account);

Which throws:

Deprecated: substr(): Passing null to parameter #1 ($string) of type string is deprecated in /var/www/html/docroot/modules/contrib/tca/tca.module on line 88

Steps to reproduce

Enable the module. Reload the page.

Proposed resolution

Fix the call.

Remaining tasks

Make this a proper patch / MR:

/**
 * Implements hook_entity_access().
 */
function tca_entity_access(EntityInterface $entity, $operation, AccountInterface $account): AccessResult|bool {
  $neutral = AccessResult::neutral()
    ->addCacheableDependency($entity)
    ->addCacheContexts(['url.path']);
  if ($operation !== 'view') {
    return $neutral;
  }
  $user_token = \Drupal::request()->query->get('tca');
  if (empty($user_token)) {
    return $neutral;
  }
  return \Drupal::service('tca.tca_access_check')->access($entity, substr($user_token, 0, 255), $account);
}

Issue fork tca-3613926

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

agentrickard created an issue. See original summary.

agentrickard’s picture

Status: Active » Needs review
silke’s picture

Can confirm that this problem exists. agentrickard's patch removes the substr() warnings - thank you!

  • lobodakyrylo committed 98a5beee on 3.1.x
    Issue #3613926 by tvaintrob, Kyrylo Loboda: Avoid passing NULL to substr...
lobodakyrylo’s picture

Status: Needs review » Fixed

Thanks for reporting this and providing the merge request.

I updated the implementation to use InputBag::getString(). This avoids passing null to substr() while preserving the existing access-check behavior when the token is missing.

Committed and pushed.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.