When any module alters the form such that the form element for the inline entity form set #access to FALSE, then the extraction of values during form submissions throws exceptions. This can be mitigated by checking if the form element exists or not. I'll post a issue fork to fix this in a minute.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

jurgenhaas created an issue. See original summary.

jurgenhaas’s picture

Status: Active » Needs review
geek-merlin’s picture

Status: Needs review » Postponed (maintainer needs more info)

Hey Jürgen, cool you report this and provide a patch. The patch looks simple, just see if something is there.

Can you elaborate a bit what use case and background is for this? Does IEF even makes sense if something is hidden? Are references deleted then (it looks like this), or not touched? TIA!

jurgenhaas’s picture

Hi Axel, sure I'm happy to provide some background information.

Our use case is that we have developed the wayfinding module which brings its own content entity type to allow content editors so enable their content to be utilized for wayfinding. This is accomplished by using the inline form module, where all the settings for the wayfinding entity are embedded in the parent content entity. Those parents can be nodes, taxonomy terms, media or any other content entity on your Drupal site.

The final result can e.g. look like this: https://www.mattenhofkriens.ch/?wayfinding=popup

The problem started to occur when we had editor roles with no permission to configure wayfinding on a particular entity. With a form alter we check that before delivering the form to the browser and set $form['wayfinding']['#access'] = FALSE; if the user has no access.

That works great but when submitting the parent entity form, we get lots of exceptions because your value extraction expects the wayfinding entity field to be there and doesn't verify that.

Hope that helps? If not, please let me know. We could even hook up in a video call for further discussion. Did you know we're located only 100 km from each other?

geek-merlin’s picture

Yay i always look where people are located ;-).

Just my gut feeling, you should not do form alter here.
You shouold use the entity access API, so you get no edit buttons in the first place.
(and off for today... ;-)

jurgenhaas’s picture

Interesting idea. I've just tried that and removed the form alter. The form itself still doesn't show up when entity access return forbidden, but the submit error is still the same.

geek-merlin’s picture

OK thanks for cross-checking that.
My fear is that if there is no access to the entity, then it will be removed from the reference. Is that the case or not?

jurgenhaas’s picture

In the new approach I'm just denying access to the entity. In the earlier approach I was denying access to the inline form.

In neither case did I remove any entity from any reference.

jurgenhaas’s picture

Status: Postponed (maintainer needs more info) » Needs review

I've re-rolled the MR to work with the latest changes from upstream.

jurgenhaas’s picture

Re-rolled the MR once again.

geek-merlin’s picture

@jurgenhaas Does the updated code work for you?

jurgenhaas’s picture

@geek-merlin yes, thanks. That looks good and still works.

xaqrox’s picture

I have a merge from the upstream that I'd like to push to the merge request so the patch can be applied, but I don't seem to have push access to the issue repo. I have set up SSH keys and everything but I still get "You are not allowed to push code to this project." ... is this what's supposed to happen?

xaqrox’s picture

Here's the patch against the latest 8.x-1.x, in lieu of a push to the merge request.

jurgenhaas’s picture

Re-rolled the MR for the latest code changes. @geek-merlin what's need to actually merge this fairly small change?

podarok’s picture

Version: 8.x-1.x-dev » 2.0.x-dev
Status: Needs review » Needs work
gugalamaciek’s picture

Patch for 3.x