Access Check Missing Warning for D10

Created on 24 August 2023, 10 months ago
Updated 22 September 2023, 9 months ago

Problem/Motivation

Upgrade status module reports a warning:
Relying on entity queries to check access by default is deprecated in drupal:9.2.0 and an error will be thrown from drupal:10.0.0. Call \Drupal\Core\Entity\Query\QueryInterface::accessCheck() with TRUE or FALSE to specify whether access should be checked.

Line 374 - web/modules/contrib/flippy/src/FlippyPager.php

Steps to reproduce

Install latest version of module (2.0.0-beta0) and enable
Run Drupal 10 upgrade status and scan flippy module
Error is listed on D10 compatibility report

Proposed resolution

Add access check to random list function.

🐛 Bug report
Status

Postponed: needs info

Version

2.0

Component

Code

Created by

🇺🇸United States wylbur Minneapolis, Minnesota, USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @wylbur
  • 🇺🇸United States wylbur Minneapolis, Minnesota, USA

    Here's a patch that resolves the D10 warning for missing access check.

  • Status changed to Needs review 10 months ago
  • Open in Jenkins → Open on Drupal.org →
    Core: 10.0.7 + Environment: PHP 8.1 & MySQL 5.7
    last update 10 months ago
    3 pass
  • Assigned to Grevil
  • Status changed to Needs work 9 months ago
  • 🇩🇪Germany Anybody Porta Westfalica

    Guess this should be TRUE, not FALSE ;)

  • Open on Drupal.org →
    Core: 10.0.7 + Environment: PHP 8.1 & MySQL 5.7
    last update 9 months ago
    Not currently mergeable.
  • @anybody opened merge request.
  • Assigned to Anybody
  • 🇩🇪Germany Anybody Porta Westfalica

    No idea what that patch does :D Not even the variable exists?

  • Open in Jenkins → Open on Drupal.org →
    Core: 10.0.7 + Environment: PHP 8.1 & MySQL 5.7
    last update 9 months ago
    3 pass
  • Assigned to Grevil
  • Status changed to Needs review 9 months ago
  • 🇩🇪Germany Anybody Porta Westfalica

    @Grevil: Please review

  • Status changed to Needs work 9 months ago
  • 🇩🇪Germany Grevil

    Seems odd to me... I guess we need to also add the access check for:

          $first = clone $query;
          $prev = clone $query;
          $next = clone $query;
          $last = clone $query;
    

    But I don't get, why we can not simply use the access check of the original query... oh well.

  • 🇩🇪Germany Anybody Porta Westfalica

    @Grevil indeed sorry! Yes the same question came to my mind... perhaps because it's a method? We shouldn't dig too deep?
    I would remove the whole clone in a refactoring, I think. Quite risky.

  • 🇩🇪Germany Grevil

    I agree, I don't even think it is possible to add an access check later on to a populated query. So removing the clone is probably our only option here... A bit unfortunate, since we create duplicate code this way...

  • 🇩🇪Germany Grevil

    On further inspection, this kind of seems like a core bug. As stated in https://www.drupal.org/node/3201242 , the warning

    Relying on entity queries to check access by default is deprecated in drupal:9.2.0 and an error will be thrown from drupal:10.0.0. Call \Drupal\Core\Entity\Query\QueryInterface::accessCheck() with TRUE or FALSE to specify whether access should be checked.

    Should only appear if accessCheck() is called without any parameters given.

    But in this case, we explicitly set 'accessCheck(TRUE)' on the original query and clone the query object 4 times, meaning the cloned object should also have their accessCheck set explicitly!

  • 🇩🇪Germany Grevil

    I just reread the issue summary and found out, that this isn't an actual error, but instead output by upgrade status...

    Have you actually seen the error get thrown using Drupal 10? My guess is, that the upgrade status module isn't smart enough to see, that the explicit access check was simply cloned from the original query object.

  • Issue was unassigned.
  • Status changed to Postponed: needs info 9 months ago
Production build 0.69.0 2024