Verified Commit 94ebeee8 authored by Jess's avatar Jess
Browse files

Issue #3386313 by kksandr, mxr576, smustgrave, xjm, catch, longwave, larowlan,... 

Issue #3386313 by kksandr, mxr576, smustgrave, xjm, catch, longwave, larowlan, fjgarlin, quietone: The entity link label formatter should check URL access
parent b58d1232

core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php

+28 −18
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 


namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;



use Drupal\Core\Cache\CacheableMetadata;

use Drupal\Core\Entity\EntityInterface;

use Drupal\Core\Entity\Exception\UndefinedLinkTemplateException;

use Drupal\Core\Field\Attribute\FieldFormatter;
@@ -61,7 +62,9 @@ public function viewElements(FieldItemListInterface $items, $langcode) { 
    $output_as_link = $this->getSetting('link');



    foreach ($this->getEntitiesToView($items, $langcode) as $delta => $entity) {

      $elements[$delta] = ['#entity' => $entity];

      $label = $entity->label();

      $cacheability = CacheableMetadata::createFromObject($entity);

      // If the link is to be displayed and the entity has a uri, display a

      // link.

      if ($output_as_link && !$entity->isNew()) {
@@ -73,12 +76,15 @@ public function viewElements(FieldItemListInterface $items, $langcode) { 
          // and it means that the entity type doesn't have a link template nor

          // a valid "uri_callback", so don't bother trying to output a link for

          // the rest of the referenced entities.

          $output_as_link = FALSE;

        }

          $elements[$delta]['#plain_text'] = $label;

          $cacheability->applyTo($elements[$delta]);

          continue;

        }



      if ($output_as_link && isset($uri) && !$entity->isNew()) {

        $elements[$delta] = [

        $uri_access = $uri->access(return_as_object: TRUE);

        $cacheability->addCacheableDependency($uri_access);

        if ($uri_access->isAllowed()) {

          $elements[$delta] += [

            '#type' => 'link',

            '#title' => $label,

            '#url' => $uri,
@@ -94,10 +100,14 @@ public function viewElements(FieldItemListInterface $items, $langcode) { 
          }

        }

        else {

        $elements[$delta] = ['#plain_text' => $label];

          $elements[$delta]['#plain_text'] = $label;

        }

      }

      $elements[$delta]['#entity'] = $entity;

      $elements[$delta]['#cache']['tags'] = $entity->getCacheTags();

      else {

        $elements[$delta]['#plain_text'] = $label;

      }



      $cacheability->applyTo($elements[$delta]);

    }



    return $elements;

core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceFormatterTest.php

+17 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
use Drupal\Core\Cache\CacheableMetadata;

use Drupal\Core\Field\FieldStorageDefinitionInterface;

use Drupal\Core\Field\Plugin\Field\FieldFormatter\EntityReferenceEntityFormatter;

use Drupal\entity_test\Entity\EntityTest;

use Drupal\field\Entity\FieldConfig;

use Drupal\field\Entity\FieldStorageConfig;

use Drupal\filter\Entity\FilterFormat;
@@ -349,6 +350,13 @@ public function testLabelFormatter(): void { 
    $renderer = $this->container->get('renderer');

    $formatter = 'entity_reference_label';



    // We need to create an anonymous user for access checks in the formatter.

    $this->createUser(values: [

      'uid' => 0,

      'status' => 0,

      'name' => '',

    ]);



    // The 'link' settings is TRUE by default.

    $build = $this->buildRenderArray([$this->referencedEntity, $this->unsavedReferencedEntity], $formatter);
@@ -407,6 +415,15 @@ public function testLabelFormatter(): void { 


    $build = $this->buildRenderArray([$referenced_entity_with_no_link_template], $formatter, ['link' => TRUE]);

    $this->assertEquals($referenced_entity_with_no_link_template->label(), $build[0]['#plain_text'], sprintf('The markup returned by the %s formatter is correct for an entity type with no valid link template.', $formatter));



    // Test link visibility if the URL is not accessible.

    $entity_with_user = EntityTest::create([

      'name' => $this->randomMachineName(),

      'user_id' => $this->createUser(),

    ]);

    $entity_with_user->save();

    $build = $entity_with_user->get('user_id')->view(['type' => $formatter, 'settings' => ['link' => TRUE]]);

    $this->assertEquals($build[0]['#plain_text'], $entity_with_user->get('user_id')->entity->label(), 'For inaccessible links, the label should be displayed in plain text.');

  }



  /**

core/modules/media/tests/src/Functional/MediaAccessTest.php

+1 −0
Original line number Diff line number Diff line
@@ -220,6 +220,7 @@ public function testMediaAccess(): void { 
    $mediaOverviewRole = $this->createRole(['access content overview', 'access media overview']);

    $this->nonAdminUser->addRole($mediaOverviewRole)->save();



    $this->grantPermissions($role, ['access user profiles']);

    $this->drupalGet('admin/content');

    $assert_session->linkByHrefExists('/admin/content/media');

    $this->clickLink('Media');