Commit 7452b5a0 authored by Zeeshaan khaan's avatar Zeeshaan khaan
Browse files

Merge branch 'entity-access-checks-security-fix' into '1.0.x' 

Add entity access checks to the add/edit dialog controller

See merge request security/185494-inline_entity_form_dialog-security!1
parents cb5b288a a77b40c5

src/Controller/InlineEntityFormDialogController.php

+15 −0
Changes for src/Controller/InlineEntityFormDialogController.php: 15 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ use Drupal\Core\Form\FormBuilderInterface; 
use Drupal\Core\Render\RendererInterface;

use Symfony\Component\DependencyInjection\ContainerInterface;

use Symfony\Component\HttpFoundation\Request;

use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;



/**

 * Renders entity forms inside a Drupal dialog for the IEFD widget.
@@ -75,6 +76,9 @@ final class InlineEntityFormDialogController extends ControllerBase { 
   *

   * @return \Drupal\Core\Ajax\AjaxResponse

   *   An AJAX response containing OpenModalDialogCommand with the entity form.

   *

   * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException

   *   Thrown when the current user does not have create access to the entity.

   */

  public function addForm(Request $request, string $entity_type_id, string $bundle): AjaxResponse {

    $entity_type = $this->entityTypeManager->getDefinition($entity_type_id);
@@ -83,6 +87,10 @@ final class InlineEntityFormDialogController extends ControllerBase { 
    $values = $bundle_key ? [$bundle_key => $bundle] : [];

    $entity = $this->entityTypeManager->getStorage($entity_type_id)->create($values);



    if (!$entity->access('create')) {

      throw new AccessDeniedHttpException();

    }



    $form_mode = $request->query->get('iefd_form_mode', 'default');

    $form = $this->entityFormBuilderService->getForm($entity, $form_mode);
@@ -112,6 +120,9 @@ final class InlineEntityFormDialogController extends ControllerBase { 
   *

   * @return \Drupal\Core\Ajax\AjaxResponse

   *   An AJAX response containing OpenModalDialogCommand with the entity form.

   *

   * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException

   *   Thrown when the current user does not have update access to the entity.

   */

  public function editForm(Request $request, string $entity_type_id, string $entity_id): AjaxResponse {

    $entity = $this->entityTypeManager
@@ -131,6 +142,10 @@ final class InlineEntityFormDialogController extends ControllerBase { 
      return $response;

    }



    if (!$entity->access('update')) {

      throw new AccessDeniedHttpException();

    }



    $form_mode = $request->query->get('iefd_form_mode', 'default');

    $form = $this->entityFormBuilderService->getForm($entity, $form_mode);