Node access check in KernelEventListener interfers with Drupal's grants system.

Created on 18 January 2023, over 1 year ago
Updated 19 January 2023, over 1 year ago

Problem/Motivation

I have a custom module in which I create my own access records and grants, giving a specific user access to a node.
They are not taken into account if PBT grants exist for this node that don't give access to said user, because of the call to handleAccessToNodePages() in Drupal\permissions_by_term\Listener\KernelEventListener class, leading to canUserAccessByNode() in AccessCheck service.

Steps to reproduce

  • Configure a taxonomy term to allow access to some users, but not the test user.
  • Add to a node a reference to this term.
  • This node's access is now restricted, test user can't view it => OK.
  • Create your own access record for this node in a custom module.
  • Add this access grant to the test user in hook_node_grants().
  • Rebuild permissions at /admin/reports/status/rebuild.
  • The user should now be able to view the node => KO.

To make it work:

  • Comment the call to handleAccessToNodePages() in KernelEventListener class.
  • The custom grant is now taken into account, test user can view the node.
  • Unset your custom grant to test PBT restrictions: test user can't view the node, as it should be.

Proposed resolution

I'm not aware of all functionalities and checks in this module, but it seems to me that there is no point in doing basic access check on node pages if node access records are enabled, as they already check access.
I would call handleAccessToNodePages() only if node access records are disabled in PBT settings.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Closed: works as designed

Version

3.1

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Status changed to Closed: works as designed over 1 year ago
Production build 0.69.0 2024