Access verification is incorrect

Created on 25 May 2023, over 1 year ago
Updated 29 June 2023, over 1 year ago

XmlSitemapLinkStorage's create method is pretty awesome.

It allows to remove entity from xml sitemap if anonymous user can't access it.

But it's incorrect.
The condition to check if user have access is based on the fact that access method return a bool.

But it's not true.
Access method can also returned an AccessResultInterface (and especially a AccessResultForbidden).

In case of AccessResultForbidden, access is not respected and entities show up in sitemap.xml

πŸ› Bug report
Status

Closed: works as designed

Version

1.4

Component

Code

Created by

πŸ‡«πŸ‡·France arnaud-brugnon

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @arnaud-brugnon
  • πŸ‡«πŸ‡·France arnaud-brugnon

    Here's a patch to solve it

  • Open in Jenkins β†’ Open on Drupal.org β†’
    Core: 10.1.x + Environment: PHP 8.1 & MariaDB 10.3.22
    last update over 1 year ago
    41 pass, 4 fail
  • Status changed to Needs review over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States dave reid Nebraska USA

    Based on the test failures and my knowledge of the access() method, you may not be correct. There is an additional argument that must be set to TRUE in order to get an object returned back, both in the case of Url::access() and EntityInterface::access() which we do not use:

            $access = $url->access($this->anonymousUser);
          }
          else {
            $loc = ($entity->id() && $entity->hasLinkTemplate('canonical')) ? $entity->toUrl()->getInternalPath() : '';
            $access = $entity->access('view', $this->anonymousUser);
    
  • Status changed to Postponed: needs info over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States dave reid Nebraska USA
  • Status changed to Needs work over 1 year ago
  • πŸ‡«πŸ‡·France arnaud-brugnon

    Sorry for the delay, i was a bit busy.

    I use bundle classes to add specific access to my bundle under some circumtances.

    Without my patch, i must return FALSE in ACCESS method to remove it from sitemap.xml

    But if i return FALSE, i got this error

    Drupal\Core\Access\AccessException: Access error in access_check.entity. Access services must return an object that implements AccessResultInterface. in Drupal\Core\Access\AccessManager->performCheck() (line 163 of core/lib/Drupal/Core/Access/AccessManager.php).

    I think it's dumb because access method is suppose to return boolean (as php doc suggest).
    But i think it's easier to fix a module core that the core itself.

  • πŸ‡«πŸ‡·France arnaud-brugnon

    Here's my code.
    Maybe you will understand better

  • πŸ‡ΊπŸ‡ΈUnited States dave reid Nebraska USA

    @arnaud-burgnon: Your implementation needs to consider the API of what you are doing and the $return_as_object parameter. You should not *only* be returning a boolean, but it should return an object or a boolean depending on that parameter.

  • Status changed to Postponed: needs info over 1 year ago
  • πŸ‡ΊπŸ‡ΈUnited States dave reid Nebraska USA

    I think if you adjusted your code to return a boolean if $return_as_object is FALSE, or an AccessResultInterface if $return_as_object is TRUE will avoid other errors, not just with the XML sitemap module. What we are doing in the module is correct, the issue is the code custom access method. I'd love to hear back if you can update it and and test again to confirm this.

  • πŸ‡«πŸ‡·France arnaud-brugnon

    Damn.
    Indeed, it was my mistake.
    I closed it.

  • Status changed to Closed: works as designed over 1 year ago
Production build 0.71.5 2024