Use comment access handler instead of hardcoding permissions

Created on 17 May 2017, over 7 years ago
Updated 20 October 2023, about 1 year ago

Problem/Motivation

The comment module comes with a CommentAccessControlHandler which is not really used on crucial places. Instead of using this handler, there are dozens of places, where the permissions provided by the comment module are checked directly (e.g. post comment permission checks instead of $entity->access('create') or access comments permission checks instead of $entity->access('view')).

For example, the $entity->access('create') access check is only used during comment link generation, but not for the comment form itself.

Due to this, it is currently impossible to create a custom access control handler for comment entities, as it would not be used where necessary. When reading through the code, you can also see there is a lot of access-related duplicate code (because the permission checks duplicate the access checks of the access control handler).

These changes will affect other issues as well, when those deal with comment access/permissions, but they are very important to get the comment entity access handling correct.

Proposed resolution

  • Scan through the code and eliminate all permission checks with proper $entity->access() checks. Search for the following permissions:
    • access comments
    • post comments
    • edit own comments

    The <em>administer comments</em> permission has been split in #3180177: [PP-2] Replaces usages of 'administer comments' permission w/ access handler checks β†’ in order to limit the scope of this issue.

  • If possible, the commenting status of the parent ID should be taken into account in the access control handler checks. As this status flag affects the entity access for certain operations, its checks should also be centralized in the access control handler
  • On "create access" the commented entity and, on comment replying, the parent comment should be passed as context as they might contain valuable information for a custom comment entity access control handler when making the decision.
  • Comment-related tests should still work as before, because only the access checking behavior is changed, but not the access requirements themselves

Remaining tasks

None.

User interface changes

None.

API changes

The current comments access checks behaviour can be altered by swapping the comment access control handler and implementing a custom access logic.

Data model changes

None.

πŸ“Œ Task
Status

Needs work

Version

11.0 πŸ”₯

Component
CommentΒ  β†’

Last updated 2 days ago

Created by

πŸ‡©πŸ‡ͺGermany hctom

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡°πŸ‡¬Kyrgyzstan sahaj

    Is the patch still needed with Drupal 10?
    As it is mentioned as 'required' by the https://www.drupal.org/project/group_comment β†’ module, it would be great to have some update.
    Thanks for any feedback.

  • πŸ‡³πŸ‡±Netherlands jaapjan

    Attached a patch for 10.1. Patch is based on 01ed69c2. Slightly adjusted for D10.

  • πŸ‡³πŸ‡±Netherlands jaapjan

    It seems I introduced a type error in the last patch when the account is not set. Updated patch. (Only addition
    $account = $account ?: \Drupal::currentUser(); in CommentFieldItemList.php).

  • πŸ‡§πŸ‡ͺBelgium keszthelyi Brussels

    This patch is identical to #136, only I removed one change introduced by this commit. I'm not sure if that permission check is needed (as view access on the parent comment is checked), and feels like it goes against the idea of the patch itself (to use access checks instead of permission checks). We use this patch together with Group Comment module, and that check would only allow replying to comments if we'd use the 'View comments' global permission, and we'd like to avoid that in favor of group permissions.

  • Pipeline finished with Skipped
    12 months ago
    #56900
  • πŸ‡¬πŸ‡§United Kingdom jaydenpearly

    Tested for version 10.3
    #136 and #137 didn't apply...

  • πŸ‡ΊπŸ‡ΈUnited States loze Los Angeles

    this is 137 rerolled for 10.3.x

  • πŸ‡ΊπŸ‡ΈUnited States loze Los Angeles
  • πŸ‡ΊπŸ‡ΈUnited States loze Los Angeles

    My patch in #139 was missing a use statement, this should work for 10.3.x

  • Pipeline finished with Failed
    about 2 months ago
    Total: 74s
    #298948
  • Pipeline finished with Failed
    about 2 months ago
    Total: 177s
    #298956
  • Pipeline finished with Failed
    about 2 months ago
    Total: 157s
    #298976
  • Pipeline finished with Success
    about 2 months ago
    Total: 349s
    #298982
  • πŸ‡¨πŸ‡¦Canada Liam Morland Ontario, CA πŸ‡¨πŸ‡¦

    liam morland β†’ made their first commit to this issue’s fork.

  • πŸ‡¨πŸ‡¦Canada Liam Morland Ontario, CA πŸ‡¨πŸ‡¦

    I have put the patch in #141 into the merge request. The person who opened the merge request, @claudiu.cristea, will need to update the merge request so that it targets branch 11.x.

  • Pipeline finished with Failed
    about 2 months ago
    Total: 298s
    #306480
  • Pipeline finished with Skipped
    about 1 month ago
    #307380
  • Pipeline finished with Success
    about 1 month ago
    Total: 176s
    #309114
  • Pipeline finished with Success
    about 1 month ago
    Total: 166s
    #309294
  • Pipeline finished with Success
    about 1 month ago
    Total: 173s
    #309381
  • Pipeline finished with Success
    about 1 month ago
    Total: 140s
    #310925
  • Pipeline finished with Success
    about 1 month ago
    Total: 339s
    #310933
  • Pipeline finished with Success
    about 1 month ago
    Total: 148s
    #310945
  • Pipeline finished with Success
    about 1 month ago
    Total: 181s
    #312300
  • Pipeline finished with Failed
    about 1 month ago
    Total: 44s
    #312728
  • Pipeline finished with Failed
    about 1 month ago
    Total: 332s
    #313279
  • Pipeline finished with Skipped
    about 1 month ago
    #314147
  • Pipeline finished with Success
    about 1 month ago
    Total: 271s
    #314163
  • Pipeline finished with Success
    about 1 month ago
    Total: 160s
    #314328
  • Pipeline finished with Success
    about 1 month ago
    Total: 347s
    #316659
  • Pipeline finished with Skipped
    about 1 month ago
    #316669
  • Pipeline finished with Success
    29 days ago
    Total: 146s
    #321958
  • Pipeline finished with Success
    27 days ago
    Total: 171s
    #322873
  • Pipeline finished with Success
    27 days ago
    Total: 134s
    #323008
  • Pipeline finished with Failed
    25 days ago
    Total: 1829s
    #325080
  • Pipeline finished with Failed
    25 days ago
    Total: 163s
    #325110
  • Pipeline finished with Success
    25 days ago
    Total: 128s
    #325749
  • Pipeline finished with Success
    25 days ago
    Total: 145s
    #325752
  • Pipeline finished with Success
    25 days ago
    Total: 131s
    #325756
  • Pipeline finished with Success
    24 days ago
    Total: 218s
    #325791
  • Pipeline finished with Skipped
    21 days ago
    #328262
  • Pipeline finished with Success
    17 days ago
    Total: 162s
    #332858
  • Pipeline finished with Success
    16 days ago
    Total: 144s
    #332931
  • Pipeline finished with Success
    13 days ago
    Total: 100s
    #335749
  • Pipeline finished with Skipped
    12 days ago
    #336086
  • Pipeline finished with Success
    12 days ago
    Total: 287s
    #336373
  • Pipeline finished with Failed
    11 days ago
    Total: 369s
    #338175
  • Pipeline finished with Failed
    11 days ago
    Total: 149s
    #338195
  • Pipeline finished with Failed
    11 days ago
    Total: 206s
    #338207
  • Pipeline finished with Failed
    11 days ago
    Total: 210s
    #338215
  • Pipeline finished with Failed
    11 days ago
    Total: 221s
    #338372
  • Pipeline finished with Failed
    11 days ago
    Total: 195s
    #338375
  • Pipeline finished with Failed
    10 days ago
    Total: 195s
    #338400
  • Pipeline finished with Failed
    10 days ago
    Total: 275s
    #338405
  • Pipeline finished with Failed
    10 days ago
    Total: 219s
    #338416
  • Pipeline finished with Failed
    10 days ago
    Total: 243s
    #338512
  • Pipeline finished with Skipped
    10 days ago
    #338718
  • Pipeline finished with Failed
    10 days ago
    Total: 339s
    #339309
  • Pipeline finished with Failed
    10 days ago
    Total: 236s
    #339314
  • Pipeline finished with Success
    10 days ago
    Total: 240s
    #339320
  • Pipeline finished with Success
    10 days ago
    Total: 250s
    #339326
  • Pipeline finished with Failed
    10 days ago
    Total: 226s
    #339335
  • Pipeline finished with Success
    9 days ago
    Total: 341s
    #339727
  • Pipeline finished with Success
    9 days ago
    Total: 297s
    #339800
  • Pipeline finished with Success
    6 days ago
    Total: 231s
    #342868
  • Pipeline finished with Success
    6 days ago
    Total: 377s
    #342871
  • Pipeline finished with Success
    4 days ago
    Total: 164s
    #344711
  • Pipeline finished with Success
    4 days ago
    Total: 208s
    #344749
Production build 0.71.5 2024