Problem/Motivation

Access checking must be explicitly specified on content entity queries since 9.2.
Change record: https://www.drupal.org/node/3201242

Steps to reproduce

Proposed resolution

Add accessCheck() to all entity queries.

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork tmgmt-3274484

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

marcusml created an issue. See original summary.

marcusml opened merge request !32

marcusml’s picture

marcusml commented
Assigned: marcusml » Unassigned
Status: Active » Needs review

I set accessCheck to TRUE for all queries except for ones in tests and update hooks.

Berdir made their first commit to this issue’s fork.

  • Berdir committed 68fb957 on 8.x-1.x authored by marcusml 
    Issue #3274484 by marcusml: Add explicit accessCheck(TRUE/FALSE) to...
berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Needs review » Fixed

Thanks. I think config entities don't even have an alter system, so that doesn't really do anything for them either way. And quite a few things could end up being very broken if someone would implement access checks for example for tmgmt_remote entities, but there's no practical reason to do so and explicitly setting it to TRUE is the same as in HEAD.

Merged.

marcusml’s picture

marcusml commented

Oh. DIdn't even think about that. Thanks for taking note!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

merilainen’s picture

merilainen commented

The upgrade status module is still complaining about this in some places, but not all. A bug in https://www.drupal.org/project/upgrade_status perhaps?
EDIT: If I move the accessCheck() just before execute() and run the scan, upgrade_status is happy. Seems to be a bug.

google01’s picture

google01 commented

In the latest versions, functions continue to appear in the code without explicit accessCheck(TRUE/FALSE) to content entity queries.

For example in the function "tmgmt_entity_delete" in the code file "tmgmt.module". This case is really worrying because it causes errors in the removal of any content, leaving Drupal 10 websites completely inoperative.