MediaLibraryFieldWidgetOpener::checkAccess denies access when modifying field values on a translated entity revision

Created on 9 February 2021, over 3 years ago
Updated 26 May 2024, 7 days ago

Problem/Motivation

When attempting to attach a media entity via the Media Library to a translated revisioned entity, it gives a 403 access denied – no reason.

The problem is in \Drupal\media_library\MediaLibraryFieldWidgetOpener::checkAccess

If the parameters from the media library state have a revision ID, it is loaded without fetching the translation from context.

    if (!empty($parameters['revision_id'])) {
      $entity = $storage->loadRevision($parameters['revision_id']);

The following access check is always forbidden:

$entity_access = $access_handler->access($entity, 'update', $account, TRUE);

When loading the translation from context, access is now allowed.

    if (!empty($parameters['revision_id'])) {
      $entity = $storage->loadRevision($parameters['revision_id']);
      $entity_repository = \Drupal::getContainer()->get('entity.repository');
      $entity = $entity_repository->getTranslationFromContext($entity);

Steps to reproduce

User with permissions:

  - 'create content translations'
  - 'delete content translations'
  - 'translate any entity'
  - 'translate editable entities'
  - 'update content translations'
  - 'create file media'
  - 'create image media'
  - 'create remote_video media'
  - 'update media'

Proposed resolution

Pass the entity to the entity repository getTranslationFromContext method.
Pending finding a solution for the case of entity translation creation (the translation can not be fetched).

Remaining tasks

Write a test.
Cover the entity translation case.
Create a Change Record.
Add trigger_error for backwards compatibility.

User interface changes

API changes

Data model changes

Release notes snippet

πŸ› Bug report
Status

Needs work

Version

11.0 πŸ”₯

Component
MediaΒ  β†’

Last updated 1 day ago

Created by

πŸ‡ΊπŸ‡ΈUnited States mglaman WI, USA

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024