Access for node is removed when an unpublished translation is added

Created on 7 September 2022, almost 2 years ago
Updated 12 June 2024, 16 days ago

Problem/Motivation

When an unpublished translation is added to a node, grants are removed from the database. This way no one can access the published original translation

Steps to reproduce

create an entity with translatable status field. No need to do any settings on the PbT side.

1: create a published node
2: save an unpublished translation
3: access is now impossible

This happens because somehow the grant hook is called with the delete flag and the grants to be saved for the node are now an empty array. I think the module doesn't take into account other translations of the node when it is saved?

🐛 Bug report
Status

Needs review

Version

3.1

Component

Code

Created by

🇫🇮Finland joey-santiago

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Merge request !17Resolve #3308318 → (Open) created by joey-santiago
  • 🇫🇮Finland joey-santiago

    Coming back to this. We noticed that the patch works indeed for that case, but doesn't cover this:

    • node with specific permissions set is created and published
    • unpublished translation is created

    in this case the patch only sets the default access, thus opening the node's permissions. Working on a fix.

  • 🇫🇮Finland joey-santiago

    Reworked the patch and confirmed tests are now passing. I plan on adding a couple tests for the case that we noticed failing, it will come next week.

  • 🇫🇮Finland joey-santiago

    Here are some more tests. I really think @peter-majmesku some effort should be put into making the module reliable with multilanguage installs.
    I had a bit of troubles understanding how the permission_mode should work, but i hope i got it right.

    thanks

  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.1 & MySQL 5.7
    last update 10 months ago
    Patch Failed to Apply
  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.1 & MySQL 5.7
    last update 10 months ago
    Patch Failed to Apply
  • 🇪🇪Estonia hkirsman

    What would be needed to test the correct branch? There's only 8.x-1.x available here.

  • 🇪🇪Estonia hkirsman

    permissions_by_term-3308318-18.patch and permissions_by_term-3308318-19.patch introduced new bug, permissions_by_term-3308318-10.patch seems to work. I'm new to to this so I thought I'd first start with fixing tests for the permissions_by_term-3308318-10.patch. Does that make sense? If that's ok, then maybe keep it for what was meant to be fixed in permissions_by_term-3308318-19.patch

  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.1 & MySQL 8
    last update 10 months ago
    Patch Failed to Apply
  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 5.3 & MySQL 5.5
    last update 10 months ago
    Patch Failed to Apply
  • 🇯🇴Jordan alaa abbad

    Reroll the patch to ensure compatibility with the most recent version.

  • 🇪🇪Estonia hkirsman

    Status check. So there's merge request and patches in this issue. The new defaultGrants() method in MR and in permissions_by_term-3308318-10.patch is exactly the same. Patch permissions_by_term-3308318-18.patch already has more logic in it. Latest patches from @joey-santiago were
    permissions_by_term-3308318-18.patch and permissions_by_term-3308318-19.patch
    Interdiff between them is:

    diff -u b/tests/src/Kernel/NodeAccessRecordsTest.php b/tests/src/Kernel/NodeAccessRecordsTest.php
    --- b/tests/src/Kernel/NodeAccessRecordsTest.php
    +++ b/tests/src/Kernel/NodeAccessRecordsTest.php
    @@ -98,25 +98,14 @@
         $node->save();
         self::assertTrue($this->isNodeAccessRecordCreatedInPBTRealm($node->id()));
     
    -    \Drupal::configFactory()->getEditable('permissions_by_term.settings')->set('permission_mode', TRUE)->save(TRUE);
    -    $term = Term::create([
    -      'name' => 'term2',
    -      'vid'  => 'test',
    -    ]);
    -    $term->save();
    -
    -    $node = Node::create([
    -      'type' => 'page',
    -      'title' => 'test_title',
    -      'field_tags' => [
    -        [
    -          'target_id' => $term->id()
    -        ]
    -      ],
    -      'language' => 'en',
    -    ]);
    -    $node->save();
    +    $translation = $node->addTranslation('fr');
    +    $translation->title->value = $this->randomString();
    +    $translation->status->value = 0;
    +    $translation->save();
         self::assertTrue($this->isNodeAccessRecordCreatedInPBTRealm($node->id()));
    +    self::assertFalse($this->isNodeAccessRecordCreatedInDefaultRealm($node->id(), 'en'));
    +    self::assertFalse($this->isNodeAccessRecordCreatedInDefaultRealm($node->id(), 'fr'));
    +
       }
     
       public function testCreateIfTermHasNoPermissionButPermissionModeIsOn(): void {
    @@ -139,6 +128,15 @@
         ]);
         $node->save();
         self::assertTrue($this->isNodeAccessRecordCreatedInPBTRealm($node->id()));
    +    self::assertFalse($this->isNodeAccessRecordCreatedInDefaultRealm($node->id(), 'en'));
    +
    +    $translation = $node->addTranslation('fr');
    +    $translation->title->value = $this->randomString();
    +    $translation->status->value = 0;
    +    $translation->save();
    +    self::assertTrue($this->isNodeAccessRecordCreatedInPBTRealm($node->id()));
    +    self::assertFalse($this->isNodeAccessRecordCreatedInDefaultRealm($node->id(), 'en'));
    +    self::assertFalse($this->isNodeAccessRecordCreatedInDefaultRealm($node->id(), 'fr'));
       }
     
       private function isNodeAccessRecordCreatedInPBTRealm(string $nid): bool {

    So more tests were added as was said in https://www.drupal.org/project/permissions_by_term/issues/3308318#commen... 🐛 Access for node is removed when an unpublished translation is added Needs review

    I'm a afraid my comment and patch in #21 might have been kind of incorrect as this is also related to https://www.drupal.org/project/drupal/issues/962664 Taxonomy Index for unpublished entities Needs work
    I would say permissions_by_term-3308318-19.patch is the last correct patch for PbT 3.1.19 and Drupal core 9.

    Problem is that the patch still fails. I would assume it was working in some env but what am I missing...

  • 🇪🇪Estonia hkirsman

    Ok, I think I get it now. The patch was only tested with the test that was updated, but not whole permissions_by_term test set. tests/src/Kernel/NodeAccessRecordsTest.php works just fine.

  • 🇪🇪Estonia hkirsman

    Got tests working on Permissions by Term version 3.1.19, Drupal core 9.3.22 (could have been probably 9.5.x). Next up is to update againast latest version of PbT and maybe Drupal 10.2

  • 🇪🇪Estonia hkirsman

    I could not create interdiff for some reason, but it the new patch should be correct. I've tested this on permissions_by_term 3.1.33 and core 10.2.7

  • Open in Jenkins → Open on Drupal.org →
    Core: 10.2.1 + Environment: PHP 8.2 & MySQL 8
    last update 16 days ago
    Patch Failed to Apply
  • 🇪🇪Estonia hkirsman

    This is also issue for testing:

  • Pipeline finished with Failed
    13 days ago
    Total: 162s
    #198996
  • Pipeline finished with Failed
    13 days ago
    #199005
  • Pipeline finished with Failed
    3 days ago
    Total: 243s
    #207666
  • Pipeline finished with Failed
    3 days ago
    Total: 165s
    #207726
  • Pipeline finished with Failed
    2 days ago
    Total: 544s
    #207777
  • Pipeline finished with Failed
    1 day ago
    Total: 188s
    #208616
  • Pipeline finished with Failed
    1 day ago
    Total: 192s
    #208656
  • Pipeline finished with Failed
    1 day ago
    Total: 262s
    #208663
  • Pipeline finished with Failed
    1 day ago
    Total: 197s
    #208664
Production build 0.69.0 2024