Commit 37a5b1a7 authored by catch's avatar catch
Browse files

Issue #3201714 by jonathanshaw, ravi.shankar, longwave, catch, alexpott:... 

Issue #3201714 by jonathanshaw, ravi.shankar, longwave, catch, alexpott: EntityQuery accessCheck: data cleanup should never care about the current user
parent c97c52b7

core/modules/comment/comment.module

+2 −2
Original line number Diff line number Diff line
@@ -171,7 +171,7 @@ function comment_field_storage_config_insert(FieldStorageConfigInterface $field_ 
function comment_field_config_delete(FieldConfigInterface $field) {

  if ($field->getType() == 'comment') {

    // Delete all comments that used by the entity bundle.

    $entity_query = \Drupal::entityQuery('comment');

    $entity_query = \Drupal::entityQuery('comment')->accessCheck(FALSE);

    $entity_query->condition('entity_type', $field->getEntityTypeId());

    $entity_query->condition('field_name', $field->getName());

    $cids = $entity_query->execute();
@@ -318,7 +318,7 @@ function comment_entity_predelete(EntityInterface $entity) { 
  // entity type that has an integer ID, $entity->id() might be a string

  // containing a number), and then cast it to an integer when querying.

  if ($entity instanceof FieldableEntityInterface && is_numeric($entity->id())) {

    $entity_query = \Drupal::entityQuery('comment');

    $entity_query = \Drupal::entityQuery('comment')->accessCheck(FALSE);

    $entity_query->condition('entity_id', (int) $entity->id());

    $entity_query->condition('entity_type', $entity->getEntityTypeId());

    $cids = $entity_query->execute();

core/modules/node/node.module

+1 −0
Original line number Diff line number Diff line
@@ -615,6 +615,7 @@ function node_user_cancel($edit, UserInterface $account, $method) { 
    case 'user_cancel_block_unpublish':

      // Unpublish nodes (current revisions).

      $nids = \Drupal::entityQuery('node')

        ->accessCheck(FALSE)

        ->condition('uid', $account->id())

        ->execute();

      module_load_include('inc', 'node', 'node.admin');

core/modules/node/tests/modules/node_access_test/node_access_test.module

+1 −1
Original line number Diff line number Diff line
@@ -79,7 +79,7 @@ function node_access_test_node_grants($account, $op) { 
function node_access_test_node_access_records(NodeInterface $node) {

  $grants = [];

  // For NodeAccessBaseTableTestCase, only set records for private nodes.

  if (!\Drupal::state()->get('node_access_test.private') || $node->private->value) {

  if (!\Drupal::state()->get('node_access_test.private') || (isset($node->private) && $node->private->value)) {

    // Groups 8888 and 8889 for the node_access_test realm both receive a view

    // grant for all controlled nodes. See node_access_test_node_grants().

    $grants[] = [

core/modules/shortcut/src/Entity/ShortcutSet.php

+1 −0
Original line number Diff line number Diff line
@@ -97,6 +97,7 @@ public static function preDelete(EntityStorageInterface $storage, array $entitie 


      // Next, delete the shortcuts for this set.

      $shortcut_ids = \Drupal::entityQuery('shortcut')

        ->accessCheck(FALSE)

        ->condition('shortcut_set', $entity->id(), '=')

        ->execute();

core/modules/system/src/Form/PrepareModulesEntityUninstallForm.php

+7 −4
Original line number Diff line number Diff line
@@ -101,7 +101,8 @@ public function buildForm(array $form, FormStateInterface $form_state, $entity_t 
    $form = parent::buildForm($form, $form_state);



    $storage = $this->entityTypeManager->getStorage($entity_type_id);

    $count = $storage->getQuery()->count()->execute();

    $count = $storage->getQuery()->accessCheck(FALSE)->count()->execute();

    $accessible_count = $storage->getQuery()->accessCheck(TRUE)->count()->execute();



    $form['entity_type_id'] = [

      '#type' => 'value',
@@ -118,8 +119,9 @@ public function buildForm(array $form, FormStateInterface $form_state, $entity_t 
        ),

      ];

    }

    elseif ($entity_type->hasKey('label')) {

    elseif ($accessible_count > 0 && $entity_type->hasKey('label')) {

      $recent_entity_ids = $storage->getQuery()

        ->accessCheck(TRUE)

        ->sort($entity_type->getKey('id'), 'DESC')

        ->pager(10)

        ->execute();
@@ -216,11 +218,12 @@ public static function deleteContentEntities($entity_type_id, &$context) { 


    if (!isset($context['sandbox']['progress'])) {

      $context['sandbox']['progress'] = 0;

      $context['sandbox']['max'] = $storage->getQuery()->count()->execute();

      $context['sandbox']['max'] = $storage->getQuery()->accessCheck(FALSE)->count()->execute();

    }



    $entity_type = \Drupal::entityTypeManager()->getDefinition($entity_type_id);

    $entity_ids = $storage->getQuery()

      ->accessCheck(FALSE)

      ->sort($entity_type->getKey('id'), 'ASC')

      ->range(0, 10)

      ->execute();
@@ -229,7 +232,7 @@ public static function deleteContentEntities($entity_type_id, &$context) { 
    }

    // Sometimes deletes cause secondary deletes. For example, deleting a

    // taxonomy term can cause its children to be deleted too.

    $context['sandbox']['progress'] = $context['sandbox']['max'] - $storage->getQuery()->count()->execute();

    $context['sandbox']['progress'] = $context['sandbox']['max'] - $storage->getQuery()->accessCheck(FALSE)->count()->execute();



    // Inform the batch engine that we are not finished and provide an

    // estimation of the completion level we reached.