Commit 49fb706d authored by Zeeshaan khaan's avatar Zeeshaan khaan
Browse files

Merge branch 'fix-search-result-access-bypass' into '1.0.x' 

Enforce entity access when returning internal link search results

See merge request security/185661-smartlinker_ai-security!1
parents b11a239e 024964c4

.cspell.json

+2 −1
Changes for .cspell.json: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -15,7 +15,8 @@ 
    "datasource",

    "ctypes",

    "guzzle",

    "Guzzle"

    "Guzzle",

    "pgvector"

  ],

  "flagWords": [

    "blacklist",

src/Plugin/AiCKEditor/SmartLinkerAI.php

+1 −3
Changes for src/Plugin/AiCKEditor/SmartLinkerAI.php: 1 added line, 3 removed lines.
Original line number Diff line number Diff line
@@ -443,7 +443,6 @@ final class SmartLinkerAI extends AiCKEditorPluginBase { 
      $query = $index->query([

        'limit' => 50,

      ]);

      $query->setOption('search_api_bypass_access', TRUE);

      $query->keys($prompt);

      // Add a condition to filter by content types.

      if (!empty($content_types)) {
@@ -457,7 +456,6 @@ final class SmartLinkerAI extends AiCKEditorPluginBase { 
        $keyword_query = $index->query([

          'limit' => 20,

        ]);

        $keyword_query->setOption('search_api_bypass_access', TRUE);

        $keyword_query->keys($keyword_prompt);

        // Add a condition to filter by content types.

        if (!empty($content_types)) {
@@ -495,7 +493,7 @@ final class SmartLinkerAI extends AiCKEditorPluginBase { 
      $node_id = $matches[1];

      // Load the node entity.

      $node = $this->entityTypeManager->getStorage('node')->load($node_id);

      if ($node instanceof NodeInterface) {

      if ($node instanceof NodeInterface && $node->access('view', $this->account)) {

        // Get the canonical URL of the node.

        $link = Url::fromRoute('entity.node.canonical', ['node' => $node_id], ['absolute' => TRUE])->toString();

        return [