RelationshipRouteAccessCheck always checks the entity in the source language

Created on 13 April 2022, about 2 years ago
Updated 22 March 2023, about 1 year ago

Problem/Motivation

We have a node that is unpublished in the source language but one of its translations is published.
When accessing one of the relationships of the translation via the JSON API without being logged, we get this error:

The current user is not allowed to view this relationship.

This seems to happen because RelationshipRouteAccessCheck::access() calls checkEntityAccess() with the source entity and not the translation.

Steps to reproduce

  1. Create a node and translate it in another language.
  2. Unpublish the original version (but not the translation).
  3. Without being logged, browse to https://example.com/[lang]/jsonapi/node/evenement/[uuid]/[some_reference...

Proposed resolution

RelationshipRouteAccessCheck::access() should fetch the translationin the current language if available.

πŸ› Bug report
Status

Needs work

Version

9.5

Component
JSON APIΒ  β†’

Last updated 1 day ago

Created by

πŸ‡«πŸ‡·France prudloff Lille

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024