Issue #3584704: Forbid NodeFormBlock access when no node type is configured

Problem

Drupal\formblock\Plugin\Block\NodeFormBlock::blockAccess() calls NodeType::load($this->configuration['type']) without checking that type is set. When the block is instantiated without a node type in its configuration (which can happen when something tries to enumerate or pre-flight-check available blocks), NodeType::load(NULL) propagates NULL into EntityStorageBase::loadMultiple([NULL]), which calls array_flip([NULL]) and emits the warning:

Warning: array_flip(): Can only flip string and integer values, entry skipped in Drupal\Core\Entity\EntityStorageBase->loadMultiple() (line 283 of core/lib/Drupal/Core/Entity/EntityStorageBase.php).

In our case the warning is emitted on every page render of the homepage because a third-party module (DXPR Builder) calls \Drupal::service('plugin.manager.block')->createInstance($block_id, []) and then $block->access() while enumerating available blocks.

Fix

Short-circuit blockAccess() to AccessResult::forbidden() when no type is configured. A block with no node type is never usable for rendering anyway, so denying access is the semantically correct answer and it silences the warning.

Issue

#3584704

Merge request reports

Loading