Module not compatible with VBO due to missing access handler

Created on 6 January 2018, over 6 years ago
Updated 31 July 2023, 11 months ago

When trying to use VBO ( View bulk operation β†’ ) in a view listing votes in order to bulk delete some of them, I got the message "access denied".
This is due to a missing access handle for the vote entity.

πŸ› Bug report
Status

Closed: duplicate

Version

3.0

Component

Code

Created by

πŸ‡§πŸ‡ͺBelgium DuneBL

Live updates comments and jobs are added and updated live.
  • Needs reroll

    The patch will have to be re-rolled with new suggestions/changes described in the comments in the issue.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.3 & MySQL 5.7
    last update 11 months ago
    6 pass, 1 fail
  • πŸ‡ΊπŸ‡ΈUnited States TR Cascadia

    Deleting votes was added in #3155268: Deleting votes β†’ . In theory I think that resolves this issue?

    I re-rolled the patch against the current HEAD. There are only two small things in this patch:

    1. Calls the parent access control function inside checkAccess(). I think this is a good addition.
    2. Changes
      -  if (!($entity instanceof VoteInterface)) {
      +  if ($entity instanceof VoteInterface) {

      This was mentioned in #2, but I don't understand why. I believe the point of the original conditional is that we're in hook_entity_delete(), which is fired any time any entity is deleted, including vote entities. But what we're trying to do here is to delete any votes on the entity that's being deleted. If it's an actual VoteInterface entity being deleted, we don't have to do anything because you can't vote on a vote.

    What I would like to hear from the community is, is this still a problem in the current version of the votingapi module? And does applying this patch change anything?

  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 10.1.x + Environment: PHP 8.1 & MySQL 5.7
    last update 11 months ago
    6 pass, 1 fail
  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 9.5.5 + Environment: PHP 7.3 & MySQL 5.7
    last update 11 months ago
    10 pass
  • πŸ‡ΊπŸ‡ΈUnited States TR Cascadia

    The test failure is caused by this:

    -  if (!($entity instanceof VoteInterface)) {
    +  if ($entity instanceof VoteInterface) {

    Here's a new patch without that. As I said above, I think this is wrong anyway.

  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 10.1.x + Environment: PHP 8.2 & MySQL 8
    last update 11 months ago
    10 pass
  • Status changed to Closed: duplicate 11 months ago
  • πŸ‡ΊπŸ‡ΈUnited States TR Cascadia

    Actually, at this point, the proposed changes are being better handled by πŸ“Œ Unable to see any voting data when creating a View based on the Vote entity. RTBC , which also contains test cases.

    If you are still seeing this problem in the most recent version of Voting API, please try the patch in that other issue and provide feedback there.

Production build 0.69.0 2024