Fix Entity queries must explicitly set whether the query should be access checked or not in Password Policy

This should be fixed with issue 3362201 where the access check is set to TRUE.

I also bumped into this today while doing a random upgrade-status check on everything for a project.

Patch looks good!

Alina,

accessCheck(TRUE) or accessCheck(FALSE)?
to me it feels that a session user with authenticated user role which trying to use the Password Policy Validation Manager
should be able to get the list of validation roles by the query.
Also if an anonymous user should have response from the system while registering.
This why I had this with accessCheck(FALSE)

Have you had issues testing with anonymous users and accessCheck(TRUE)?
I'm sure you will face issues.

I'm only for any. the old logic was like accessCheck(FALSE) under Drupal 9.
But under Drupal 10 it is a must have access check.
Having the default change.

Open for a better logic

The old logic was like accessCheck(FALSE) under Drupal 9.

Isn't it the other way around?

If ::accessCheck() is not called, then the query defaults to checking access, i.e. behaves as if ::accessCheck(TRUE) had been called. This behavior has been the source of many bugs, as it is easy for developers to forget that this happens.

Source: https://www.drupal.org/node/3201242 →

However, given the context of the query here I think setting it to FALSE here is fine since it's about the roles the current user is in.

Yes, Bram, you are right :)

Assigning to myself as I'm reviewing/merging ready RTBC fixes/updates over the next few days.

For some reason, I'm not able to reproduce the error though I've seen these before for other things. Please add detailed steps to reproduce. Looking at the code, it looks fine and I agree, based on the usage, that FALSE is correct. I'm happy to merge this once I'm able to reproduce the error and see it fixed with the MR/patch.

I can see this in the upgrade_status report, so assigning back to me.

Applying the patch fixed the upgrade_status report.

The fix has been merged and will be part of the next release.

Kristen Pol → credited bapi_22 → .

Kristen Pol → credited joseph.olstad → .

Kristen Pol → credited tsquared212 → .

Adding credit for those who worked on the duplicate issue:

📌 Drupal 10 compatibility fixes for Password Policy Closed: duplicate

Kristen Pol → credited bata.laci → .

Kristen Pol → credited sarwan_verma → .

Adding credit for those who worked on another duplicate issue:

📌 Drupal 10 compatibility - to check access by default is deprecated in drupal:9.2.0 and an error will be thrown from drupal:10.0.0. Closed: duplicate

Automatically closed - issue fixed for 2 weeks with no activity.

This is part of the new 4.0.1 release → .