Fix Entity queries must explicitly set whether the query should be access checked or not in Varbase Media

Created on 16 March 2023, almost 2 years ago

Updated 29 May 2023, over 1 year ago

Problem/Motivation

Having the following error after finishing the installation.

Error message
Entity queries must explicitly set whether the query should be access checked or not. See Drupal\Core\Entity\Query\QueryInterface::accessCheck().

Proposed resolution

Have queries over entities changed in the Varbase Media module
With basic accessCheck(TRUE) or pass the needed access check for admins or selected user roles and permissions.
📌 Updated EmbedCKEditorPluginBase to load embed buttons with loadByProperties() instead of entity query Fixed

Access checking must be explicitly specified on content entity queries →
#2785449: It's too easy to write entity queries with access checks that must not have them →

BEFORE

// This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->condition('type', 'article')
  ->execute();

// This also gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(TRUE)
  ->condition('type', 'article')
  ->execute();

// This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(FALSE)
  ->condition('type', 'article')
  ->execute();

AFTER

// This will trigger a deprecation error.
$ids = \Drupal::entityQuery('node')
  ->condition('type', 'article')
  ->execute();

// Unchanged: This gets all articles the current user can view.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(TRUE)
  ->condition('type', 'article')
  ->execute();

// Unchanged: This gets all articles that exist regardless of access.
$ids = \Drupal::entityQuery('node')
  ->accessCheck(FALSE)
  ->condition('type', 'article')
  ->execute();