Contrib.social

Entity reference selection handlers do not check the "create" access for autocreated entities

Open on Drupal.org →
Created on 6 July 2023, over 1 year ago
Updated 17 July 2023, over 1 year ago

Problem/Motivation

When using an autocompletion element in an entity reference field widget, there is a feature to create entities automatically, in case the typed in labels of the entity aren't found. This is most commonly used to allow users to create new taxonomy terms if no matching ones are found.

While this makes sense for terms, it's a bit awkward for other entity types that can be created using only a label. Since many sites likely rely on this behavior, the fix should take into account existing field widgets and not require sites to grand wide sweeping permissions to what are now "low" or even anonymous uers.

Steps to reproduce

Give a user access to an autocomplete entity reference field widget that references an entity type / bundle they do not have access to, and make sure to enable the autocreate feature. They should be able to create entities automatically by using the widget since the "create" access check isn't being performed.

Proposed resolution

Perform the "create" access check before creating new entities during entity reference autocomplete, without breaking existing sites.

Remaining tasks

Discuss impact on existing sites, write a patch.

User interface changes

None, unless this is opt-in in the field widget config level.

API changes

TBD

Data model changes

TBD

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component
Entity  →

Last updated about 8 hours ago

Created by

🇺🇸United States samuel.mortenson

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Comments & Activities

  • Issue created by @samuel.mortenson
  • Comment over 1 year ago →
    🇨🇭Switzerland berdir Switzerland

    > While this makes sense for terms, it's a bit awkward for other entity types that can be created using only a label.

    I think that's neither an issue nor relevant to this. Allowing auto-create is already an option on the field, if you don't need it or it doesn't make sense for the given entity type, then the setting can just be not enabled, it's off by default.

    That's why I'm unsure what to do about this and if it's even really a bug as it is. A bug would require a "fix", which would definitely cause issues on many sites.

    The only idea I have atm is to make it a feature, with a "[ ] Respect create access, only users with the necessary permission can create new entities", then have that off on existing fields and on by default on new ones?

  • Comment over 1 year ago →
    🇨🇭Switzerland berdir Switzerland

    Also, should this have a security tag?

  • Comment over 1 year ago →
    🇬🇧United Kingdom catch

    The only idea I have atm is to make it a feature, with a "[ ] Respect create access, only users with the necessary permission can create new entities", then have that off on existing fields and on by default on new ones?

    This also seems like the only way to handle both cases, but I can't really think of a use-case where you'd want this particular UX. You could have curated entity refs with autocomplete (which we already allow for), but then would you want admins using the autocomplete UI to create new ones? And if you really needed that, a custom/contrib widget might be an option rather than adding clutter to the UI here.

    Another thing would be adding to the description of the existing setting to note that it doesn't require 'create' entity access - i.e. just document the existing behaviour a bit more explicitly.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024