Problem/Motivation

accessCheck() is missing on deleteEntity

Steps to reproduce

delete node(s) with business rules.

Proposed resolution

in : src/Plugin/BusinessRulesAction/DeleteEntity.php
on line 60 :

- $ids = $query->execute();
+ $ids = $query->accessCheck()->execute();

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork business_rules-3432325

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

perpignan created an issue. See original summary.

dineshkumarbollu made their first commit to this issue’s fork.

dineshkumarbollu opened merge request !18

dineshkumarbollu’s picture

dineshkumarbollu commented
Status: Active » Needs review

Access checking must be explicitly specified on content entity queries, see https://www.drupal.org/node/3201242

raveen_thakur51’s picture

raveen_thakur51 commented

@Yes, accessCheck() to your query ensures that only data accessible to the current user based on their permissions is returned, enhancing the security.
** MR! has quickfix & can be merged.
Thank you

rcodina’s picture

rcodina
Primary language Catalan
Location Barcelona
commented
Version: 3.0.0-beta1 » 3.x-dev

Thanks!