Skip to content

Commit 49bdcfa

Browse files
mglamanmglaman
committed
Add samples from Drupal core for entity query access
issue #396
1 parent 12397d1 commit 49bdcfa

File tree

4 files changed

+147
-0
lines changed

4 files changed

+147
-0
lines changed

‎tests/src/Rules/EntityQueryHasAccessCheckRuleTest.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,5 +49,23 @@ public function cases(): \Generator
4949
[__DIR__ . '/data/bug-438.php'],
5050
[]
5151
];
52+
yield [
53+
[__DIR__.'/data/bug-396a.php'],
54+
[
55+
[
56+
'Missing explicit access check on entity query.',
57+
27,
58+
'See https://www.drupal.org/node/3201242',
59+
]
60+
]
61+
];
62+
yield [
63+
[__DIR__ . '/data/bug-396b.php'],
64+
[]
65+
];
66+
yield [
67+
[__DIR__ . '/data/bug-396c.php'],
68+
[]
69+
];
5270
}
5371
}

‎tests/src/Rules/data/bug-396a.php‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<?php
2+
3+
namespace Bug396a;
4+
5+
function () {
6+
$query = \Drupal::entityQuery('user')
7+
->condition('status', 1)
8+
->condition('uid', 1, '<>')
9+
->condition('field_profile_visibility', 1)
10+
->condition('field_account_type', '', '<>')
11+
->condition('field_last_name.value', '', '<>');
12+
if( isset($qparam['expertise']) && !empty($qparam['expertise']) ) {
13+
$query->condition('field_field_expertise.entity.tid', $qparam['expertise']);
14+
}
15+
if( isset($qparam['origin']) && !empty($qparam['origin']) ) {
16+
$query->condition('field_place_origin.entity:taxonomy_term.field_country_tags', $qparam['origin']);
17+
}
18+
if( isset($qparam['place_residence']) && !empty($qparam['place_residence']) ) {
19+
$query->condition('field_place_residence.entity:taxonomy_term.field_country_tags', $qparam['place_residence']);
20+
}
21+
if( isset($qparam['city']) && !empty($qparam['city']) ) {
22+
$query->condition('field_city', $qparam['city'], 'CONTAINS');
23+
}
24+
if( isset($qparam['user_type']) && !empty($qparam['user_type']) ) {
25+
$query->condition('field_account_type.entity.tid', $qparam['user_type']);
26+
}
27+
$users = $query->execute();
28+
};
29+
function () {
30+
$query = \Drupal::entityQuery('user')
31+
->accessCheck(FALSE)
32+
->condition('status', 1)
33+
->condition('uid', 1, '<>')
34+
->condition('field_profile_visibility', 1)
35+
->condition('field_account_type', '', '<>')
36+
->condition('field_last_name.value', '', '<>');
37+
if( isset($qparam['expertise']) && !empty($qparam['expertise']) ) {
38+
$query->condition('field_field_expertise.entity.tid', $qparam['expertise']);
39+
}
40+
if( isset($qparam['origin']) && !empty($qparam['origin']) ) {
41+
$query->condition('field_place_origin.entity:taxonomy_term.field_country_tags', $qparam['origin']);
42+
}
43+
if( isset($qparam['place_residence']) && !empty($qparam['place_residence']) ) {
44+
$query->condition('field_place_residence.entity:taxonomy_term.field_country_tags', $qparam['place_residence']);
45+
}
46+
if( isset($qparam['city']) && !empty($qparam['city']) ) {
47+
$query->condition('field_city', $qparam['city'], 'CONTAINS');
48+
}
49+
if( isset($qparam['user_type']) && !empty($qparam['user_type']) ) {
50+
$query->condition('field_account_type.entity.tid', $qparam['user_type']);
51+
}
52+
$users = $query->execute();
53+
};
54+
function () {
55+
$query = \Drupal::entityQuery('user')
56+
->condition('status', 1)
57+
->condition('uid', 1, '<>')
58+
->condition('field_profile_visibility', 1)
59+
->condition('field_account_type', '', '<>')
60+
->condition('field_last_name.value', '', '<>');
61+
if( isset($qparam['expertise']) && !empty($qparam['expertise']) ) {
62+
$query->condition('field_field_expertise.entity.tid', $qparam['expertise']);
63+
}
64+
if( isset($qparam['origin']) && !empty($qparam['origin']) ) {
65+
$query->condition('field_place_origin.entity:taxonomy_term.field_country_tags', $qparam['origin']);
66+
}
67+
if( isset($qparam['place_residence']) && !empty($qparam['place_residence']) ) {
68+
$query->condition('field_place_residence.entity:taxonomy_term.field_country_tags', $qparam['place_residence']);
69+
}
70+
if( isset($qparam['city']) && !empty($qparam['city']) ) {
71+
$query->condition('field_city', $qparam['city'], 'CONTAINS');
72+
}
73+
if( isset($qparam['user_type']) && !empty($qparam['user_type']) ) {
74+
$query->condition('field_account_type.entity.tid', $qparam['user_type']);
75+
}
76+
$query->accessCheck(FALSE);
77+
$users = $query->execute();
78+
};

‎tests/src/Rules/data/bug-396b.php‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?php
2+
3+
namespace Bug396b;
4+
5+
use Drupal\Core\Entity\EntityTypeManagerInterface;
6+
7+
class Foo {
8+
private EntityTypeManagerInterface $entityTypeManager;
9+
private string $entityTypeId;
10+
public function __construct(EntityTypeManagerInterface $entityTypeManager)
11+
{
12+
$this->entityTypeManager = $entityTypeManager;
13+
$this->entityTypeId = 'node';
14+
}
15+
public function a(): int {
16+
/** @var \Drupal\Core\Entity\TranslatableRevisionableStorageInterface|\Drupal\Core\Entity\EntityStorageInterface $storage */
17+
$storage = $this->entityTypeManager->getStorage($this->entityTypeId);
18+
return $storage->getQuery()->accessCheck(FALSE)->count()->execute() + 1;
19+
}
20+
}

‎tests/src/Rules/data/bug-396c.php‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<?php
2+
3+
namespace Bug396c;
4+
5+
use Drupal\Core\Entity\EntityStorageInterface;
6+
7+
class EntityQueryTest {
8+
private EntityStorageInterface $storage;
9+
public function setUp(): void {
10+
$this->storage = \Drupal::entityTypeManager()->getStorage('entity_test_mulrev');
11+
}
12+
public function a(): int {
13+
$query = $this->storage
14+
->getQuery('OR')
15+
->accessCheck(FALSE)
16+
->exists('abcfoo', 'tr')
17+
->condition("abd.color", 'red')
18+
->sort('id');
19+
$count_query = clone $query;
20+
return $count_query->count()->execute();
21+
}
22+
public function b(): int {
23+
$query = $this->storage
24+
->getQuery('OR')
25+
->accessCheck(FALSE)
26+
->exists('abcfoo', 'tr')
27+
->condition("abd.color", 'red')
28+
->sort('id');
29+
return $query->count()->execute();
30+
}
31+
}

0 commit comments

Comments
 (0)