Fix Entity queries must explicitly set whether the query should be access checked or not in Entityqueue Form Widget

Created on 14 March 2023, over 1 year ago

Problem/Motivation

Having the following error after finishing the installation.

Error message
Entity queries must explicitly set whether the query should be access checked or not. See Drupal\Core\Entity\Query\QueryInterface::accessCheck().

Proposed resolution

Have queries over entities changed in the Entityqueue Form Widget module
With basic accessCheck(TRUE) or pass the needed access check for admins or selected user roles and permissions.

Access checking must be explicitly specified on content entity queries
#2785449: It's too easy to write entity queries with access checks that must not have them

BEFORE

// This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->condition('type', 'article')
  ->execute();

// This also gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(TRUE)
  ->condition('type', 'article')
  ->execute();

// This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(FALSE)
  ->condition('type', 'article')
  ->execute();

AFTER

// This will trigger a deprecation error.
$ids = \Drupal::entityQuery('node')
  ->condition('type', 'article')
  ->execute();

// Unchanged: This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(TRUE)
  ->condition('type', 'article')
  ->execute();

// Unchanged: This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(FALSE)
  ->condition('type', 'article')
  ->execute();

Remaining tasks

  • ✅ File an issue
  • ✅ Addition/Change/Update/Fix
  • ✅ Testing to ensure no regression
  • ➖ Automated unit testing coverage
  • ➖ Automated functional testing coverage
  • ➖ UX/UI designer responsibilities
  • ➖ Readability
  • ✅ Accessibility
  • ➖ Performance
  • ➖ Security
  • ➖ Documentation
  • ✅ Code review by maintainers
  • ✅ Full testing and approval
  • ✅ Credit contributors
  • ✅ Review with the product owner
  • ✅ Release notes snippet
  • ✅ Release entityqueue_form_widget-2.0.5

API changes

  • N/A

Data model changes

  • N/A

Release notes snippet

  • Issue #3347916 : Fixed Entity queries must explicitly set whether the query should be access checked or not
🐛 Bug report
Status

Fixed

Version

2.0

Component

Code

Created by

🇯🇴Jordan Rajab Natshah Jordan

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024