Contrib.social

namespace "api_key: causes access denied if a form has element also called 'api_key'

Open on Drupal.org →
Created on 5 December 2017, over 7 years ago
Updated 31 January 2025, 3 months ago

Hi,
I am using this module and it works very well, however I came across an issue.

I have a contrib module which sets a form element called "api_key" like so:

  /**
   * {@inheritdoc}
   */
  public function buildForm(array $form, FormStateInterface $form_state) {
    $config = $this->config('okta_api.settings');
    $form['api_key'] = [
      '#type' => 'textfield',
      '#title' => $this->t('API Token'),
      '#description' => $this->t('The API token to use.'),
      '#default_value' => $config->get('api_key'),
    ];

Ever time i submitted the custom form above, I was getting access denied errors. After some debugging it turned out that this code below was getting called:

ApiKeyAuth.php

  public function authenticate(Request $request) {
    // Load config entity.
    $api_key_entities = \Drupal::entityTypeManager()
      ->getStorage('api_key')
      ->loadMultiple();
    foreach ($api_key_entities as $key_item) {

      if ($this->getKey($request) == $key_item->key) {
        $accounts = $this->entityTypeManager->getStorage('user')->loadByProperties(array('uuid' => $key_item->user_uuid));
        $account = reset($accounts);

...

and 

  /**
   * @param $request
   * @return bool
   */
  public function getKey(Request $request) {
    $form_api_key = $request->get('api_key');
    $api_key = isset($form_api_key) ? $form_api_key : $request->query->get('api_key');

    return isset($api_key) ? $api_key : FALSE;
  }

This was causing access denied issues on any form which had a foem element with "api_key". I suggest we change the name space to make it something specific, such as: "services_api_key"

Thoughts?

🐛 Bug report
Status

Fixed

Version

3.0

Component

Code

Created by

🇬🇧United Kingdom dakku

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024