TermStorage::loadParents()/getChildren()/getTree() need an option to specify accessCheck(FALSE)

Created on 23 January 2018, almost 7 years ago
Updated 9 October 2023, about 1 year ago

Problem/Motivation

When loading terms using TermStorage::loadParents()/getChildren()/getTree() it should be easier to ignore the current user's access.

Proposed resolution

Add an optional access check parameter to these methods.

Remaining tasks

None.

User interface changes

None.

API changes

Added optional param, default behavior unchanged.

Data model changes

None.

πŸ“Œ Task
Status

Needs work

Version

11.0 πŸ”₯

Component
TaxonomyΒ  β†’

Last updated about 1 hour ago

  • Maintained by
  • πŸ‡ΊπŸ‡ΈUnited States @xjm
  • πŸ‡¬πŸ‡§United Kingdom @catch
Created by

πŸ‡¬πŸ‡§United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡ΊπŸ‡ΈUnited States smustgrave
  • πŸ‡¬πŸ‡§United Kingdom longwave UK

    Re #28 I looked into contrib, and found that config_terms will indeed be broken if we change this under the 1:1 rule: it provides an alternative storage that extends ConfigEntityStorage but that implements TermStorageInterface, see https://git.drupalcode.org/project/config_terms/-/blob/8.x-1.x/src/TermS...

    However, with the commented out parameter, how will we notify config_terms that it needs to change in future to accommodate this? Can the debug classloader help us here?

  • πŸ‡¬πŸ‡§United Kingdom catch

    DebugClassloader does have some support for this:

      self::$annotatedParameters[$class][$method-                 >name][$parameterName] = sprintf('The "%%s::%s()" method will require a new     "%s$%s" argument in the next major version of its %s "%s", not defining it is   deprecated.', $method->name, $parameterType ? $parameterType.' ' : '',          $parameterName, interface_exists($class) ? 'interface' : 'parent class',        $method->class);
    

    I can't find any documentation for it though, so we'd probably need to reverse engineer from a Symfony example.

  • πŸ‡¬πŸ‡§United Kingdom longwave UK

    Ah, I remember where I've seen this before: we explicitly skip this in deprecation-ignore.txt:

    %The "Drupal\\[^"]+" method will require a new "[^"]+" argument in the next major version of its interface "Drupal\\[^"]+", not defining it is deprecated%
    
  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    Sorry dropped the ball here. So is any changes needed to the latest patch?

  • πŸ‡¦πŸ‡ΊAustralia larowlan πŸ‡¦πŸ‡ΊπŸ.au GMT+10

    I think the next steps here @smustgrave is to confirm that the debug classloader reports this as a deprecation when running tests for config terms module.

    If it doesn't we'll need to revisit why we have that entry in deprecation-ignore.txt

  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    I will admit I'm not sure how to go about doing that..

    Should it be moved to NW then?

  • Status changed to Needs work over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States smustgrave

    Per #36.

    I'm not sure how to do that though unfortunately.

  • πŸ‡ΊπŸ‡ΈUnited States partdigital

    I've run into this issue as well while working on the Access policy contrib module

    My use case:
    In access policy I can define different access rules that allow me to dynamically add conditions via `hook_query_TAG_alter`
    I've created a Node access policy with an access rule called "Compare node tags with tags on current user (with depth)". This allows me to restrict content by ensuring the tags on the node either match the tags on the user or are a child of one of the tags on the user.

    This works fine for restricting view access. However, it does not work when I attempt to limit what tags are available in the entity reference field on the node edit form. It triggers an infinite loop.

    This is because, in order to restrict taxonomy terms, I also add an access policy for those terms. This also invokes hook_query_TAGS_alter but it also calls TermStorage::nodeTree which also calls hook_query_TAG_alter()

    This is a contrib module so including a core patch with the contrib module is really not feasible.

    So I'm left with a few options:

    • Either create a new EntityReferenceSelection plugin just for that field. (Not ideal)
    • Or decorate `TermStorage` with a new `loadTreeBypassAccess` method. (Also not ideal).
Production build 0.71.5 2024