Verified Commit 1019986c authored by Dave Long's avatar Dave Long
Browse files

Issue #3336994 by mxr576, kksandr, dpi, smustgrave, xjm, alexpott, hchonov,...

Issue #3336994 by mxr576, kksandr, dpi, smustgrave, xjm, alexpott, hchonov, quietone: StringFormatter always displays links to entity even if the user in context does not have access

(cherry picked from commit 4c8c814c)
parent 7bf317d4
Loading
Loading
Loading
Loading
Loading
+12 −5
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@

namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;

use Drupal\Core\Cache\CacheableMetadata;
use Drupal\Core\Entity\EntityInterface;
use Drupal\Core\Entity\EntityTypeManagerInterface;
use Drupal\Core\Field\Attribute\FieldFormatter;
@@ -122,27 +123,33 @@ public function settingsSummary() {
   */
  public function viewElements(FieldItemListInterface $items, $langcode) {
    $elements = [];
    $url = NULL;
    $entity = $items->getEntity();
    $entity_type = $entity->getEntityType();

    $render_as_link = FALSE;
    if ($this->getSetting('link_to_entity') && !$entity->isNew() && $entity_type->hasLinkTemplate('canonical')) {
      $url = $this->getEntityUrl($entity);
      $access = $url->access(return_as_object: TRUE);
      (new CacheableMetadata())
        ->addCacheableDependency($access)
        ->applyTo($elements);
      $render_as_link = $access->isAllowed();
    }

    foreach ($items as $delta => $item) {
      $view_value = $this->viewValue($item);
      if ($url) {
      if ($render_as_link) {
        assert(isset($url));
        $elements[$delta] = [
          '#type' => 'link',
          '#title' => $view_value,
          '#title' => $this->viewValue($item),
          '#url' => $url,
        ];
      }
      else {
        $elements[$delta] = $view_value;
        $elements[$delta] = $this->viewValue($item);
      }
    }

    return $elements;
  }

+1 −1
Original line number Diff line number Diff line
@@ -181,7 +181,7 @@ public function testListing(): void {
    $this->drupalGet('admin/content/block');
    $this->assertSession()->statusCodeEquals(200);
    $this->assertSession()->linkNotExists($link_text);
    $matches = $this->xpath('//td/a');
    $matches = $this->xpath('//td[1]');
    $actual = $matches[0]->getText();
    $this->assertEquals($label, $actual, 'Label found for test block.');
    $this->assertSession()->linkNotExists('Edit');
+10 −3
Original line number Diff line number Diff line
@@ -56,7 +56,11 @@ protected function setUp($import_test_views = TRUE): void {

    $admin_role = Role::create([
      'id' => 'admin',
      'permissions' => ['administer comments', 'access user profiles'],
      'permissions' => [
        'administer comments',
        'access user profiles',
        'access comments',
      ],
      'label' => 'Admin',
    ]);
    $admin_role->save();
@@ -177,8 +181,11 @@ public function testUsername(): void {
    $this->assertNoLink($this->adminUser->label());
    // Note: External users aren't pointing to drupal user profiles.
    $this->assertLink('barry (not verified)');
    $this->assertLink('My comment title');
    $this->assertLink('Anonymous comment title');
    // Anonymous user does not have access to this link but can still see title.
    $this->assertText('My comment title');
    $this->assertNoLink('My comment title');
    $this->assertText('Anonymous comment title');
    $this->assertNoLink('Anonymous comment title');
  }

}
+9 −2
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@
use Drupal\field\Entity\FieldConfig;
use Drupal\field\Entity\FieldStorageConfig;
use Drupal\KernelTests\KernelTestBase;
use Drupal\Tests\user\Traits\UserCreationTrait;

/**
 * Tests the creation of text fields.
@@ -20,6 +21,8 @@
 */
class StringFormatterTest extends KernelTestBase {

  use UserCreationTrait;

  /**
   * {@inheritdoc}
   */
@@ -68,7 +71,10 @@ protected function setUp(): void {
    // Configure the theme system.
    $this->installConfig(['system', 'field']);
    $this->installEntitySchema('entity_test_rev');
    $this->installEntitySchema('entity_test_label');
    $this->setUpCurrentUser(permissions: [
      'view test entity',
      'administer entity_test content',
    ]);

    $this->entityType = 'entity_test_rev';
    $this->bundle = $this->entityType;
@@ -124,7 +130,7 @@ public function testStringFormatter(): void {
    $value .= "\n\n<strong>" . $this->randomString() . '</strong>';
    $value .= "\n\n" . $this->randomString();

    $entity = EntityTestRev::create([]);
    $entity = EntityTestRev::create(['name' => 'view revision']);
    $entity->{$this->fieldName}->value = $value;

    // Verify that all HTML is escaped and newlines are retained.
@@ -194,6 +200,7 @@ public function testStringFormatter(): void {
   */
  public function testLinkToContentForEntitiesWithNoCanonicalPath(): void {
    $this->enableModules(['entity_test']);
    $this->installEntitySchema('entity_test_label');
    $field_name = 'test_field_name';
    $entity_type = $bundle = 'entity_test_label';

+6 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@

use Drupal\entity_test\Entity\EntityTest;
use Drupal\KernelTests\KernelTestBase;
use Drupal\Tests\user\Traits\UserCreationTrait;

/**
 * Tests the output of a UUID field.
@@ -14,6 +15,7 @@
 */
class UuidFormatterTest extends KernelTestBase {

  use UserCreationTrait;

  /**
   * {@inheritdoc}
@@ -28,6 +30,10 @@ protected function setUp(): void {

    $this->installConfig(['system', 'field']);
    $this->installEntitySchema('entity_test');
    $this->installEntitySchema('user');
    $this->setUpCurrentUser(permissions: [
      'view test entity',
    ]);
  }

  /**
Loading