Problem/Motivation

checkParentEntityAccess() reuses the same $operation for both an entity access check and a field access check:

if (!$parentEntity->access($operation, $account)) { ... }        // entity-level: view/update/delete                                                                                                                       
if (!$parentEntityField->access($operation, $account)) { ... }   // field-level: only view/edit                                                                                                                              

Field access only ever expects "view" or "edit" (per core's fieldAccess() contract). When the entity-level 'update' peration reaches the second line unchanged, it breaks modules that enforce that contract ? e.g. field_permissions throws an AssertionError for any linkchecker-tracked field set to permission_type: custom.

See
https://git.drupalcode.org/project/field_permissions/-/blob/8.x-1.x/src/...
https://git.drupalcode.org/project/drupal/-/blob/11.x/core/lib/Drupal/Co...

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

alorenc created an issue. See original summary.

alorenc’s picture

Assigned: Unassigned » alorenc
alorenc’s picture

Assigned: alorenc » Unassigned
Status: Active » Needs review
andras_szilagyi’s picture

Status: Needs review » Reviewed & tested by the community

confirm the issue and fix

joelpittet made their first commit to this issue’s fork.

  • joelpittet committed 33ec0fdf on 2.1.x authored by alorenc
    fix: #3620347 checkParentEntityAccess() passes "update" into a field...
joelpittet’s picture

Status: Reviewed & tested by the community » Fixed

Thanks @alorenc, I added a regression test (red/green) and the merge train has left the station 🚉

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.