Domain access: TypeError in hook_node_grants can completely crash site

one of my colleague also faced this issue
there was no any issue in modules or core file
Actually he was copying whole DB and source code to different machine and trying to run drupal
later we find the users table does not contain 0 uid
and it was actually at 14 uid, then we updated 14 -> 0 uid and it seems all work fine

Just to confirm, I have a user with uid 0 and I'm still facing the error.
After applying the patch from #5, it works fine. I suggest considering the issue and reviewing the suggested patch again.

Patch #5 is working and fixed issue for me.

Other code breaking the API is not our responsibility. That issue should be filed upstream with the caller.

I have a user with uid 0 and I'm still facing the error.
The suggested changes in patch #5 work for me. however, I am using the 2.0.0-beta2 version and couldn't apply the patch. So based on #5 I have created patch 6 which works well.

AccountInterface instance can have no ID in valid use cases, even though the AccountInterface does not say so (but should).

A good example is the Search API RenderedItem processor: a User(Session) is created on the fly to render and index entities for that user's role. This user is never saved, thus has no ID.
See https://git.drupalcode.org/project/search_api/-/blob/8.x-1.x/src/Plugin/...

Should the AccountInterface get updated to reflect the fact that the ID can be NULL, it still needs to be handled here.

I do not think that is valid. It is an abuse of the API. If anything, it should be caught upstream before hook_node_grants is called.

Also, the link to the code does not seem relevant to this issue. That code seems to have moved https://git.drupalcode.org/project/search_api/-/blob/8.x-1.x/src/Plugin/...

Could you provide an MR on 2.0.x-dev branch please?

Rerolled patch for latest dev

Someone for a MR?

Some phpcs and phpstan warnings need to be fixed.

joris drupal → made their first commit to this issue’s fork.

Let's try to get this in the next release.

Removing from next release for now.

I'm a bit annoyed by that return TRUE; in the checkEntityAccess method that seems to bypass security here.

An explanation anyone?

@mably re comment #27, yes I saw that,

I assumed it was letting anonymous users view content on all domains as it was not explicitly forbidden by the users setting.

I was also wondering why that checkEntityAccess was not returning an AccessResult instead of a true

Looking at the module's domain_access_node_access it will return a neutral for anonymous users and checkEntityAccess will never get invoked...

@joris-drupal so can we set it back to FALSE by default?

@mably

Yes, if there is no user it should be FALSE.

Even if the anonymous role has any off the

• 'view unpublished domain content'
• 'update ' . $type . ' content on assigned domains'
• 'edit domain content'
• 'delete ' . $type . ' content on assigned domains'
• 'delete domain content'

permissions it should return FALSE as the anonymous user just does not have a DomainAccessManagerInterface::DOMAIN_ACCESS_FIELD or a DomainAccessManagerInterface::DOMAIN_ACCESS_ALL_FIELD setting

Those permission should not be given to the anonymous user anyway...

Merged. Thanks to all!