- First commit to issue fork.
- πͺπΈSpain vidorado Pamplona (Navarra)
@smustgrave, to properly test this, we would need a comprehensive kernel test for the
FileAccessControlHandler
. I feel uneasy about testing just the 'update' operation solely to ensure that a PHP notice is not triggered. Could you provide some guidance on the best way to test cases like this? Additionally, is a full test of theFileAccessControlHandler
within the scope of this issue?Thank you!
- Merge request !10927Issue #2988632: File entity - Dblog/Watchdog entries if uid is NULL β (Open) created by vidorado
- πΊπΈUnited States smustgrave
There's AccessTest that probably can be expanded
- πͺπΈSpain vidorado Pamplona (Navarra)
Thanks for pointing it out. Now I see that
\Drupal\Tests\file\Kernel\AccessTest
already tests the update operation over a file with and without owner, so I believe we have this covered! :) haven't we?I've debugged step by step and checked that the new code is exercised.
... $this->assertFalse($file1->access('update', $user_own)); $this->assertTrue($file2->access('update', $user_own)); ... // Create a file with no user entity. // <<Creates $file4 with no uid>> $this->assertFalse($file4->access('update', $user_own)); ... $this->assertFalse($file4->access('update', $user_any));
- πΊπΈUnited States smustgrave
Then I would say not. If the test coverage were adequate it would catch the bug reported here. So think the coverage needs to be expanded to cover the scenario described.
- πͺπΈSpain vidorado Pamplona (Navarra)
You're right, and now I've seen that a
isset()
guard was added in π There is no way to delete file entities of other users Fixed after this issue was created, so this is not longer a problem. I think we can close this issue as outdated.if ($account->id() == $file_uid[0]['target_id']) {
Was changed to:
if (isset($file_uid[0]['target_id']) && $account->id() == $file_uid[0]['target_id']) {
It was better to check for
$entity->getOwnerId()
rather than$file_uid = $entity->get('uid')->getValue()
and$file_uid[0]['target_id']
, but I think that's now out of the scope of this issue.