Path validation constraint prevents saving of node that uses entitygroupfield

Created on 3 February 2022, about 3 years ago
Updated 24 February 2023, about 2 years ago

Problem/Motivation

We're using the entitygroupfield module on a node type. An author is allowed to edit the node, but when he saves it he gets the following errr message.

Either the path '/group/123/content/456' is invalid or you do not have access to it.

The reason is, that the entitygroupfield widget builds the subform, even though the author does not have the permission to create aliases and does not have the "update any group_node:page content". Building the subform will trigger the subform validation, which triggers the error mentioned above.

Steps to reproduce

Proposed resolution

The subform should only be attached to the element, if the if ($item_mode == 'edit' && $can_edit) {. Only the first part of the condition is currently used.

This will make it possible for the user to store the node, without any influence by the other group_node.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Needs work

Version

1.0

Component

Widgets

Created by

πŸ‡©πŸ‡ͺGermany szeidler Berlin

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡¨πŸ‡¦Canada gwvoigt London, ON πŸ‡¨πŸ‡¦

    This patch is causing an issue when I create a node and add to a group using /node/add route:

    The website encountered an unexpected error. Please try again later.
    TypeError: Drupal\Component\Utility\NestedArray::getValue(): Argument #2 ($parents) must be of type array, null given, called in /app/docroot/core/lib/Drupal/Core/Field/WidgetBase.php on line 426 in Drupal\Component\Utility\NestedArray::getValue() (line 69 of core/lib/Drupal/Component/Utility/NestedArray.php).
    Drupal\Component\Utility\NestedArray::getValue(Array, NULL) (Line: 426)
    Drupal\Core\Field\WidgetBase->flagErrors(Object, Object, Array, Object) (Line: 268)
    Drupal\Core\Entity\Entity\EntityFormDisplay->flagWidgetsErrorsFromViolations(Object, Array, Object) (Line: 255)
    Drupal\Core\Entity\Entity\EntityFormDisplay->validateFormValues(Object, Array, Object) (Line: 762)
    Drupal\entitygroupfield\Plugin\Field\FieldWidget\EntityGroupFieldWidgetBase->elementValidate(Array, Object, Array)
    call_user_func_array(Array, Array) (Line: 282)
    Drupal\Core\Form\FormValidator->doValidateForm(Array, Object) (Line: 238)
    Drupal\Core\Form\FormValidator->doValidateForm(Array, Object) (Line: 238)
    Drupal\Core\Form\FormValidator->doValidateForm(Array, Object) (Line: 238)
    Drupal\Core\Form\FormValidator->doValidateForm(Array, Object, 'node_page_form') (Line: 118)
    Drupal\Core\Form\FormValidator->validateForm('node_page_form', Array, Object) (Line: 588)
    Drupal\Core\Form\FormBuilder->processForm('node_page_form', Array, Object) (Line: 320)
    Drupal\Core\Form\FormBuilder->buildForm(Object, Object) (Line: 73)
    Drupal\Core\Controller\FormController->getContentResult(Object, Object)
    call_user_func_array(Array, Array) (Line: 123)
    Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->Drupal\Core\EventSubscriber\{closure}() (Line: 564)
    Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 124)
    Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->wrapControllerExecutionInRenderContext(Array, Array) (Line: 97)
    Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->Drupal\Core\EventSubscriber\{closure}() (Line: 159)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 81)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 58)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 48)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 106)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 85)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 50)
    Drupal\ban\BanMiddleware->handle(Object, 1, 1) (Line: 265)
    Drupal\shield\ShieldMiddleware->bypass(Object, 1, 1) (Line: 132)
    Drupal\shield\ShieldMiddleware->handle(Object, 1, 1) (Line: 48)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 51)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
    Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 709)
    Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

    I thought it was permission related but I gave the editor role full permissions in both global and group permissions and that error would still happen. I have no issues when I create a node using the /group/4/content/create/group_node route. In this case, my editor role is a mapped to the global editor role.

  • Status changed to Needs work about 2 years ago
  • πŸ‡¨πŸ‡¦Canada gwvoigt London, ON πŸ‡¨πŸ‡¦
  • πŸ‡ΊπŸ‡ΈUnited States dww

    It's been about 2 years since I looked at any of this code πŸ˜…, but doesn't the widget have the notion of sort of a read-only display for folks who can see the group associations but not edit them? Is that what's causing the trouble here? Can/should we implement that in a different way so that we're not actually directly using the whole FormAPI to add read-only markup?

    Regardless, it'd be great to have some automated test coverage to demonstrate the bug, both so we know we're fixing it, and so we're sure we don't break it in the future.

    Thanks,
    -Derek

Production build 0.71.5 2024