NodeForm::actions() checks for delete access on new entities

Created on 16 April 2016, about 9 years ago
Updated 30 January 2023, about 2 years ago

At the bottom of NodeForm::actions() the following line calls the entity access system with a 'delete' operation and an entity without an ID (because it's new) when using node add forms. This may lead to crashes in entity access hooks as you'd expect the 'delete' operation to be run against an existing entity.

Also, seeing as the parent ::actions() call only defines the 'delete' form key when the entity isn't new, it makes sense to alter that part of the form only if the key actually exists. It's just cleaner code...

For reference, it caused a crash here: #2706893: Fatal error when creating a node at /node/add/NODE_TYPE

🐛 Bug report
Status

Needs work

Version

9.5

Component
Node system 

Last updated about 1 hour ago

No maintainer
Created by

🇧🇪Belgium kristiaanvandeneynde Antwerp, Belgium

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • The Needs Review Queue Bot tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

    Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

    Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

  • Status changed to Needs review about 2 years ago
  • Status changed to Needs work about 2 years ago
  • 🇺🇸United States smustgrave

    This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request as a guide.

    Hiding files as the fix is being done in MR 3347

    Moving to NW as there are failures in the MRs

    Did not test or review yet.

  • First commit to issue fork.
  • 🇦🇺Australia acbramley

    Rebased onto 11.x and made some minor changes. Updated IS and title to match solution.

  • 🇦🇺Australia acbramley

    We have one failure which I can reproduce locally NodeAccessLanguageTest::testNodeAccess

    I think this is something weird with the caching changes, the lines just before the failing assertion set the catalan nodes as "accesible" via some state and then check that they're still not accessible based on static caching:

        // Make Catalan accessible.
        \Drupal::state()->set('node_access_test_secret_catalan', 0);
    
        // Tests that Catalan is accessible on a node with a Catalan version as the
        // static cache has not been reset.
       $this->assertNodeAccess($expected_node_access_no_access, $node_public_ca, $web_user);
    

    Since we're testing the delete operation last based on $expected_node_access_no_access I expect that's nuking the static cache or something? In any case this seems like fragility in this specific test rather than an actual problem in the solution.

Production build 0.71.5 2024