_access tag can leading to fatal error

Created on 9 September 2021, almost 3 years ago
Updated 17 February 2023, over 1 year ago

Problem/Motivation

In "group_query_entity_query_alter()" we have $entity_type_manager->getDefinition($entity_type_id)
Without getting into the details why $entity_type_id can be empty, it's a sane coding suggestion to check variable emptiness before making assumptions.

This query alteration breaks Core Views Facets β†’ integration

See: https://www.drupal.org/project/core_views_facets/issues/3177272 πŸ› It can crash in combination with other modules Active

Steps to reproduce

1. Install core_views_facets
2. Create a view (page) with exposed filters
3. Add facets for this page
4. Activate the group module
5. Visit the page and experience a crashed page

Proposed resolution

Ensure $entity_type_id is not empty before making assumptions.

πŸ› Bug report
Status

Closed: won't fix

Version

3.0

Component

Code

Created by

πŸ‡¬πŸ‡§United Kingdom hugronaphor

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡³πŸ‡ΏNew Zealand RoSk0 Wellington

    Facing this bug on the views data export displays on the 3.0.0-beta6 and the patch fixes the problem for us.

    Feels like a major really.

  • Status changed to Needs review over 1 year ago
  • πŸ‡³πŸ‡ΏNew Zealand RoSk0 Wellington

    Re-roll for the latest 3.x.

  • πŸ‡³πŸ‡ΏNew Zealand RoSk0 Wellington

    Tested on the latest 3.0.0-rc1 - issue persist.

    And back to RTBC for greens!

  • Status changed to RTBC over 1 year ago
  • πŸ‡³πŸ‡ΏNew Zealand RoSk0 Wellington
  • Status changed to Closed: won't fix over 1 year ago
  • πŸ‡§πŸ‡ͺBelgium kristiaanvandeneynde Antwerp, Belgium

    If a query is tagged as an entity query, it needs to have an entity type set as its metadata.

    If some modules (VBO, core_view_facets, ...) decide to maim a query by removing parts of the metadata while keeping others, that's their issue. This has nothing to do with "sane coding suggestions", as it's a perfectly valid expectation for there to be metadata present. If anything, it's good that Group doesn't check and crashes the page because now you know some module you're using is doing some really funky stuff.

    This bug has been reported with VBO+Group and it turned out to be a bug in VBO, now it's reported with core_view_facets and voila: #3177272-5: core_views_facets module can crash in combination to other modules β†’

    Not planning on "fixing" this as there is nothing to fix unless proven otherwise.

  • Status changed to Active over 1 year ago
  • πŸ‡³πŸ‡ΏNew Zealand RoSk0 Wellington

    If a query is tagged as an entity query

    this is not completely true, well not true at all. group adds 'entity_type' to metadata in group_views_query_alter() , together with 'views_entity_query' tag based on which group_query_views_entity_query_alter() the query is then sent to group_query_entity_query_alter(), but the problem is that \Drupal\views\Plugin\views\query\Sql::query() passes on tags to the queries generated with it, but it regenerates the query every time it's called. And queries generated by views doesn't have entity query tag on them.

    Agree that original patch doesn't really addresses the issue, but there is definitely an issue here. I created πŸ› Query metadata get lost when $view->query->query() is called multiple times during page build Active get some feedback from the core on this subject.

    Maybe the implementation of the group_views_query_alter() could be improved to pass around entity type somehow? In my case views_data_export calls $view->query->query()->countQuery()->execute(); to get total rows count and that doesn't look terribly wrong, but that call $view->query->query() generates a new SQL query and the entity type set in group_views_query_alter() is not preserved.

  • Status changed to Closed: won't fix over 1 year ago
  • πŸ‡§πŸ‡ͺBelgium kristiaanvandeneynde Antwerp, Belgium

    group_views_query_alter() has several checks to make sure it does not add the 'entity_type' metadata willy-nilly. When it does add it, it's because we're dealing with a View that we found represents a given entity type. At that point we do not tag the entity as an entity query, but we do use a custom tag to make sure we can invoke our logic that would otherwise run on an entity query.

    core_views_facets, however, along with other modules that have so far broken on this piece of Group code, all either have an entity query or a View where they run custom code that strips important data from the query.

    So again: There are two routes to group_query_entity_query_alter():

    1. An entity query, or a query which pretends to be one - via core directly
    2. A view that deals with an entity type or pretends to do so - via group_views_query_alter()

    Both scenarios work, provided no-one stripped valuable metadata along the way.

    So, respectfully, @RoSk0 I do not see where you find my previous statement not to be true at all. Group is right to expect the metadata to be set and, in case it's not, the problem always lies where the metadata is destroyed. If this happens to be in core, then it should be fixed as a bug in core.

    Setting back to "Won't fix" as there is nothing I can do here and working around a bug in someone else's code (even if core) is something I'd rather not do. The right way ahead is to fix that bug elsewhere.

Production build 0.69.0 2024