RelationshipRouteAccessCheck always checks the entity in the source language

Created on 13 April 2022, almost 3 years ago

Updated 22 March 2023, almost 2 years ago

Problem/Motivation

We have a node that is unpublished in the source language but one of its translations is published.
When accessing one of the relationships of the translation via the JSON API without being logged, we get this error:

The current user is not allowed to view this relationship.

This seems to happen because RelationshipRouteAccessCheck::access() calls checkEntityAccess() with the source entity and not the translation.

Steps to reproduce

Create a node and translate it in another language.
Unpublish the original version (but not the translation).
Without being logged, browse to https://example.com/[lang]/jsonapi/node/evenement/[uuid]/[some_reference...

Proposed resolution

RelationshipRouteAccessCheck::access() should fetch the translationin the current language if available.

🐛 Bug report

Status

Needs work

Version

9.5

Component

JSON API →

Last updated 9 days ago

Maintained by
@e0ipso
🇳🇱Netherlands @bbrala
@gabesullice
🇧🇪Belgium @wim leers

Created by

🇫🇷France prudloff Lille

Live updates comments and jobs are added and updated live.

Needs tests
The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment almost 2 years ago →
🇫🇷France prudloff Lille

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024