Access checking must be explicitly specified on content entity queries [#3250738]

Problem/Motivation

Relying on entity queries to check access by default is deprecated in drupal:9.2.0 and an error will be thrown from drupal:10.0.0. Call \Drupal\Core\Entity\Query\QueryInterface::accessCheck() with TRUE or FALSE to specify whether access should be checked. See https://www.drupal.org/node/3201242

Proposed resolution

Add explicit ->accessCheck() calls on entity queries.

Issue fork workflow-3250738

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3250738-access-checking-must changes, plain diff MR !4
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

22 November 2021 at 19:12

piggito created an issue. See original summary.

Comment #2

piggito commented 22 November 2021 at 19:17

Issue summary:

View changes

Comment #3

22 November 2021 at 19:17

piggito opened merge request !4

Comment #4

piggito commented 22 November 2021 at 19:18

Assigned:	piggito	» Unassigned
Status:	Active	» Needs review

Comment #5

gribnif commented 17 May 2022 at 16:57

I noticed that in all cases in the current MR the argument TRUE is being passed to accessCheck(). I think each case needs to be evaluated more closely, as it's likely that FALSE is a better value to use. As it is now, there may be cases where data is not updated because of the TRUE.