LanguageNegotiationUrl processOutbound unnecessarily sets base_url

Created on 29 February 2024, 11 months ago

Problem/Motivation

The initial problem is that the File Listing page "Delete" link fails with "Oops, something went wrong. Check your browser's developer console for more details." when language negotiation uses domains.

I selected the "language system" component, but this problem spans subsystems.

Steps to reproduce

0. Setup two domains (.ddev/config.yaml additional_hostnames, I used "local" and "es.local").
1. Install Drupal, enable media and language modules.
2. Add a language for the second domain on admin/config/regional/language (I used Spanish). Configure detection on admin/config/regional/language/detection, edit "URL", select "Domain", and set the two domain URL's (I used local.ddev.site and es.local.ddev.site)
3. Add a media document from admin/content/media
4. Try to delete the file just added on admin/content/files. You will see the error "Oops, something went wrong. Check your browser's developer console for more details."

Proposed resolution

This is a rabbit hole. Working backwards:

ConfirmFormHelper::buildCancelLink() needs a URL. It tries to get it from either the destination parameter or from the entity URL. I think we need to fix both code paths.

Problem #1 - destination

We can't get it from the destination parameter because language negotiation converts the relative URL to a full URL which is then sanitized by RequestSanitizer.

a. Use 🐛 Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error Closed: duplicate , however once this is applied, we run into Problem #3.
b. Change LanguageNegotiationUrl::outboundUrl() to not set the base_path if it matches the current page's base_path.

Problem #2 - File Entity

If the destination parameter is missing, the URL is retrieved from toUrl() which throws the exception that started this problem. Previous attempts have been made (see [#3371753} and 🐛 [regression] Entity::toUrl() without argument is broken for entity types with a URI callback Needs review ) to make this not fail, but this still doesn't work for File entities. I can fix my local sites problem with https://drupal.org/project/file_entity which adds the necessary link templates but a contrib solution to a core problem is only an interim fix. We should look there for the minimal required templates to add to core.

Problem #3 - buildCancelLink() external URLs

This code has a rather old comment to "revisit" #2418219: Deprecate destination URLs that don't include the base path . I think that Drupal has moved past this issue, and won't ever revisit it, so IMO we should comment on the issue, and remove the comment.

The try/catch was added in #2512452: Confirm form cancel button can lead to external domain to prevent external URL's, but does not use, and should use, UrlHelper::externalIsLocal() which could now be used.

🐛 Bug report
Status

Active

Version

10.2

Component
Language system 

Last updated about 2 hours ago

  • Maintained by
  • 🇩🇪Germany @sun
Created by

🇺🇸United States douggreen Winchester, VA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @douggreen
  • 🇺🇸United States douggreen Winchester, VA
  • 🇺🇸United States douggreen Winchester, VA
  • 🇺🇸United States douggreen Winchester, VA
  • First commit to issue fork.
  • Pipeline finished with Success
    11 months ago
    Total: 459s
    #107858
  • 🇮🇳India sukr_s

    Support for delete-form is required. I've tested this and it works fine.

  • Pipeline finished with Failed
    11 months ago
    Total: 163s
    #107915
  • Status changed to RTBC 11 months ago
  • 🇺🇸United States jenlampton

    Changing to RTBC after the last comment.

  • Status changed to Needs work 11 months ago
  • 🇬🇧United Kingdom catch

    It's not clear to me whether this will fix the original bug report, would be good to add some test coverage if the lack of this is causing user-facing fatal errors. Could also use an issue summary update.

  • Assigned to PrabuEla
  • Pipeline finished with Failed
    10 months ago
    Total: 172s
    #132319
  • Pipeline finished with Failed
    10 months ago
    Total: 169s
    #132324
  • Pipeline finished with Failed
    10 months ago
    Total: 499s
    #132328
  • Issue was unassigned.
  • Status changed to Needs review 10 months ago
  • 🇮🇳India sukr_s

    - Issue summary updated. error screenshot added.
    - New test case added
    - Screenshot post fix added

    The MR has failed at test case testUnmanagedGitIgnoreWhenGitNotAvailable which seems unrelated to the code fix. what should be done?

  • Status changed to Needs work 10 months ago
  • 🇺🇸United States smustgrave

    Appears to have test failures

  • Pipeline finished with Failed
    10 months ago
    Total: 555s
    #134101
  • Pipeline finished with Success
    10 months ago
    Total: 487s
    #134107
  • Status changed to Needs review 10 months ago
  • Status changed to RTBC 10 months ago
  • 🇺🇸United States smustgrave

    Issue summary appears to be updated with solution in #13 so removing that tag

    Ran test only feature and got

    1) Drupal\Tests\file\Functional\FileListingTest::testFileDeleteWithMultipleDomain
    Behat\Mink\Exception\ResponseTextException: The text "Are you sure you want to delete the file image-test.png?" was not found anywhere in the text of the current page.
    /builds/issue/drupal-3424701/vendor/behat/mink/src/WebAssert.php:907
    /builds/issue/drupal-3424701/vendor/behat/mink/src/WebAssert.php:293
    /builds/issue/drupal-3424701/core/tests/Drupal/Tests/WebAssert.php:956
    /builds/issue/drupal-3424701/core/modules/file/tests/src/Functional/FileListingTest.php:331
    /builds/issue/drupal-3424701/vendor/phpunit/phpunit/src/Framework/TestResult.php:728
    ERRORS!
    Tests: 3, Assertions: 187, Errors: 1.
    

    So removing that tag

    Seems additional condition for deletion seems to be there.

  • Status changed to Needs work 10 months ago
  • 🇬🇧United Kingdom catch

    This seems like it would come from lib/Drupal/Core/Entity/EntityListBuilder.php but that passes in 'delete-form' to ::toUrl().

    I think we need a backtrace here with what is calling ::toUrl() with NULL, and fix it there, or at least understand what's going wrong a bit more. Seems weird to default to deleting just because there's no canonical or edit link. Also the exception message would need to be updated which is not done in the MR.

  • 🇬🇧United Kingdom catch

    Is it this in the actual delete form?

     /**
       * {@inheritdoc}
       */
      public function getCancelUrl() {
        $entity = $this->getEntity();
        if ($entity->hasLinkTemplate('collection')) {
          // If available, return the collection URL.
          return $entity->toUrl('collection');
        }
        else {
          // Otherwise fall back to the default link template.
          return $entity->toUrl();
        }
      }
    

    If so, I think the problem is file module missing a 'collection' link for the cancel link to point to, it shouldn't point to the delete page, that's what we're on.

  • Pipeline finished with Failed
    10 months ago
    Total: 2045s
    #142465
  • Pipeline finished with Failed
    10 months ago
    Total: 988s
    #142510
  • Pipeline finished with Success
    10 months ago
    Total: 992s
    #142533
  • Status changed to Needs review 10 months ago
  • 🇮🇳India sukr_s

    - IS updated
    - fix as per #20 done

  • Status changed to Needs work 10 months ago
  • 🇬🇧United Kingdom catch

    Sorry I don't think that fix is right either because views is an optional module and therefore the route may or may not exist.

    Couple of questions:

    1. What happens if we remove the exception from EntityBase::toUrl() and fall back to <front> for the route there - I don't think that's the correct fix but I would like to see what happens.

    2. It would be useful to manually test this in 10.1 or 10.0.x from before the regression was introduced, and see what the cancel button actually did on this form, I have a feeling the button was broken but it rendered and no-one ever noticed.

  • Pipeline finished with Failed
    10 months ago
    Total: 2457s
    #143485
  • Pipeline finished with Success
    10 months ago
    Total: 1051s
    #143539
  • Status changed to Needs review 10 months ago
  • 🇮🇳India sukr_s

    If the views module does not exist, then this screen is not accessible and therefore it's not possible to reach the error.

    I tried to add the collection route conditionally but the REST tests fail.

    1. If the exception is commented out, it tries to create URL with entity.file.collection and ends up throwing an exception. If that is commented out too and URL to is created, then the dialog pops up. Click on cancel, it remains on the same page.
    2. The problem occurs only when the language module is enabled and multiple languages are configured. If it's a single language site then the functionality works fine. The cancel stays on the same page, which would be the expected behavior. If multiple languages are configured then the delete confirmation popup doesn't open, it ends up with exception.

    If the original fix of adding 'delete-form' is enabled then the delete confirmation pops-up and clicking on cancel, it remains on the same page.

  • Status changed to Needs work 10 months ago
  • 🇺🇸United States smustgrave

    Proposed solution shouldn't point to a comment, for ease of review please update issue summary with actual proposed solution.

    Find saying "Go to this link" the same as when people put "see patch"

  • Status changed to Needs review 10 months ago
  • 🇮🇳India sukr_s

    @smustgrave the correct solution needs to be confirmed by @catch. once done can update the same

    putting it back to NR for @catch attention.

  • Status changed to Needs work 10 months ago
  • 🇬🇧United Kingdom catch

    If the views module does not exist, then this screen is not accessible and therefore it's not possible to reach the error.

    I think it would still be possible to browser to the URL, and definitely possible to set up an alternative view at a different path to do the same thing (or just change the path on the default view).

    I think someone should do this:

    It would be useful to manually test this in 10.1 or 10.0.x from before the regression was introduced, and see what the cancel button actually did on this form, I have a feeling the button was broken but it rendered and no-one ever noticed.

    Once we know what the original behaviour was and whether it was broken already in a different way, it will help inform what the solution here should be.

    Also, does this really require language negotiation to reproduce?

  • 🇮🇳India sukr_s

    Results of manual testing

    10.0.8 - View does not provide the option to delete.

    10.1.0
    - Without language module enabled, Delete confirmation is shown and clicking Cancel, closes the dialog
    - With language module enabled, Error as per screenshot error-on-delete.png

  • 🇮🇳India sukr_s

    After further analysis, I've found that the URL generated for delete without language module or language with url detection is

    https://d10n.ddev.site/file/1/delete?destination=/admin/content/files&_wrapper_format=drupal_modal

    and with language module with domain detection is

    https://d10n.ddev.site/file/1/delete?destination=https%3A//d10n.ddev.site/admin/content/files&_wrapper_format=drupal_modal

    the issue is that in the second case the destination is a fully qualified url and in the first case it's relative path. Since we have fully qualified URL, the request sanitize function removes the destination URL and thus it ends up in getCancelUrl and subsequently throws the error.

  • Pipeline finished with Failed
    10 months ago
    Total: 990s
    #151180
  • Pipeline finished with Failed
    10 months ago
    Total: 989s
    #151199
  • Pipeline finished with Success
    10 months ago
    Total: 1107s
    #151268
  • Status changed to Needs review 10 months ago
  • 🇮🇳India sukr_s

    removing "needs manual testing" tag. done in #28

  • Status changed to Needs work 9 months ago
  • 🇺🇸United States smustgrave

    Comment in MR.

  • Status changed to Needs review 9 months ago
  • 🇮🇳India sukr_s

    without correcting the assertion, the test will fail. do confirm if you want this to be removed. will the merge happen with test failing?

  • Status changed to Needs work 8 months ago
  • 🇺🇸United States agentrickard Georgia (US)
  • 🇬🇧United Kingdom alexpott 🇪🇺🌍
  • 🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺
  • 🇺🇸United States smustgrave

    So going to pivot since the todo and test update is needed here. Lets expand test coverage to make sure it includes scenarios in 🐛 Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error Closed: duplicate . Which I'll close and move over credit for.

  • Pipeline finished with Failed
    8 months ago
    Total: 989s
    #190061
  • Pipeline finished with Success
    8 months ago
    Total: 536s
    #190563
  • Status changed to Needs review 8 months ago
  • 🇮🇳India sukr_s

    The test case testBlockPlacementIndicator in BlockUITest.php has the issue described in 🐛 Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error Closed: duplicate . This has been fixed. I don't think we need additional test case for this.

  • 🇫🇷France nicodh

    Works for me (I had the issue described in #2980527: Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error).

  • Status changed to RTBC 8 months ago
  • 🇺🇸United States smustgrave

    Fine if we don't expand test coverage. Will let committers decide if needed though.

  • Status changed to Needs work 7 months ago
  • 🇳🇿New Zealand quietone

    Thanks for the working on improving multi-lingual sites!

    An issue summary update removed a large block of testing and explanation that I found useful to help understand this issue. Maybe that should be restored?

    I read the comments and MR at 🐛 Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error Closed: duplicate the fix there is very different from this. That MR was created by a core committer and another core committer worked on this issue. I think we need to get confirmation of which solution is preferred. Apologies if I missed it. For now, I will tag for framework manager review. The other issue also has test and it would help to know if that should be kept or not.

    There are also comments in the MR to resolve.

  • 🇮🇳India sukr_s

    An issue summary update removed a large block of testing and explanation that I found useful to help understand this issue. Maybe that should be restored?

    restored original proposed solution

  • Status changed to Needs review 6 months ago
  • Status changed to RTBC 5 months ago
  • 🇩🇪Germany sleitner

    solves the problem. All threads were resolved. The large block of testing was restored.

  • 🇬🇧United Kingdom catch

    Looks like this needs work based on @quietone's review.

  • Pipeline finished with Success
    4 months ago
    Total: 554s
    #316700
  • Status changed to Needs review 3 months ago
  • 🇬🇧United Kingdom slawrence10 London

    This same problem exists in Drupal 10 but wasn't sure how to document it?

    Error thrown when trying to delete file entities at /admin/content/files

    Turn off URL detection that uses domain at /admin/config/regional/language/detection, clear cache and file entities can be deleted error free.

  • 🇺🇸United States smustgrave

    Updated proposed solution to mention that the todo around https://www.drupal.org/project/drupal/issues/2980527 🐛 Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error Closed: duplicate is also being removed.

    Resolved the rest of the threads and believe all feedback has been addressed.

    Only request I would make is if the MR can be rebased since it's 800+ commits back.

  • Pipeline finished with Success
    about 1 month ago
    Total: 787s
    #385434
  • 🇺🇸United States smustgrave

    Thanks believe all feedback has been addressed

  • 🇨🇭Switzerland berdir Switzerland

    Feels like the issue that was closed as a duplicate better (more generically) describes what this is about, while this issue title is just about one specific aspect of that? Maybe we should update it?

  • Pipeline finished with Failed
    22 days ago
    Total: 477s
    #396112
  • Pipeline finished with Failed
    17 days ago
    Total: 501s
    #400303
  • Status changed to RTBC 14 days ago
  • 🇳🇿New Zealand quietone

    From #53, Trying for a better title.

Production build 0.71.5 2024