Since #3001496: Add an alter hook to EntityQuery it's been possible to alter an EntityQuery, however, there is no getter for the $accessCheck property so it's impossible use the hooks for access checking without using reflection
.
1. Implement one of the entity query alter hooks.
2. Try to determine if the query has accessCheck set to TRUE without using reflection.
Add a getter for accessCheck so that the property can be accessed without reflection.
The simplest way to do this would be to add asymmetric visibility, but since we support PHP 8.3 we'll need to define a new method.
N/A
Since accessCheck is already taken, perhaps hasAccessCheck could work?
Adding a new method to Drupal\Core\Entity\Query\QueryInterface.
N/A
TBD
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
davidwbarratt commentedComment #4
davidwbarratt commentedComment #5
smustgrave commentedThanks for the suggestion
Will probably need a simple test case around this and probably convert 1-2 spots in core that could use this to show it's needed.
Comment #6
davidwbarratt commentedI'm kind of shocked that hook_query_TAG_alter, at least for the purposes of access, is only used by
nodein core with NodeHooks1::queryNodeAccessAlter which is kind of a beast.Ironically, the example for hook_query_TAG_alter is a hypothetical for the
mediamodule that would be greatly simplified by this change, which wouldn't use that hook in the first place.I'm not sure where a test should therefore belong? This change is effectively only useful for contrib modules to utilize until someone wants to take on the work of refactoring node access, in which this change I imagine would be helpful.
Any guidance you can provide would be helpful!
Comment #7
davidwbarratt commentedIt seems outside of the scope of this issue, but we could add a hook_entity_query_ENTITY_TYPE_alter for an entity type like
user? For instance, if a user doesn't have theaccess user profilespermission and the queryhasAccessCheckthan the query should immediately return zero results right?Comment #8
davidwbarratt commentedWe could persue a more comprehensive solution, which I've documented in #777578-245: Add an entity query access API and deprecate hook_query_ENTITY_TYPE_access_alter()
Comment #9
davidwbarratt commentedI'm closing this because a more comprehensive solution is needed. I've documented the problem more clearly at #3514221: QueryInterface::accessCheck does not perform access checking in core
Comment #10
davidwbarratt commented