Hi,

I am just putting this out as a ‘thought’ regarding Domain Access and Drupal 7 Entities. There are many relate/relationship modules being developed such as:

Relation: http://drupal.org/project/relation
Entity Reference Field: http://drupal.org/project/ref_field
Entity Reference: http://drupal.org/project/entityreference
Entity API: http://drupal.org/project/entity

In a nutshell (for this example), an 'entity' can be a node. However in the above modules that I am testing, it doesn’t matter what node DA is set to, the Entity Field system obviously doesn’t filter the usual way that a node would (I understand the history of this). So to obtain entities (of nodes) placed on a node field with domain access information is not working as all field entities are returned (ie. there is no knowledge/filtering by domain setting – where the entity is a node type).

The only module that works on filtering the domain information is:

References (like D6 ‘node references’) http://drupal.org/project/references

This particular module ‘filters’ the nodes correctly and is domain aware (I will take a look at the code on this). I think it works on field filtering using a strongly ‘node typed’ method the way other node access functions work and not using Entity API.

I just wanted to put this out there for ideas/discussion in the future regarding Domain Access with Entity Fields and filtering as it will become quite popular with many modules/systems to come.

If you have any thoughts on this I can show this to the developers of the respective modules for their input on future DA integration with Entity types (e.g. nodes having domain setting info).

Hope this makes some sense!

Tim

Comments

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Version: 7.x-2.x-dev » 7.x-3.x-dev

Actually, it doesn't.

Are you specifically talking about Entity Reference fields on nodes?

I suspect this is a core problem, since node access rules should apply to nodes, but don't apply to other entity types.

So I think you're asking about an expanded entity access rule set. Is that about right?

Tim Jones Toronto’s picture

Tim Jones Toronto commented

>Actually, it doesn't.

No problem! Let me try again...

As one example using the module 'Entity Reference Fields' to create a system so that nodes can reference another node (set as an Entity) and be related to each other:

In my simple example I create a node type called 'News'. I want to make this node have 'related' news stories, so create an Entity reference field (called 'related_news') that points to other nodes of type 'News'.

Everything works fine: when editing the node you can reference other news stories using the Autocomplete widget. The only problem is that the Entity reference field 'related_news' on the edit form populates and shows ALL NODES created FROM ALL DOMAINS irrespective of their domain assignment. You only want it to show the nodes assigned on the domain being edited (this is where References module *does* actually work and creates a filtered list (on domain) for populating the widget Autocomplete display).

>you're asking about an expanded entity access rule set. Is that about right?

Yes (maybe) - some system where an Entity inherits the domain access property if the Entity type is a 'node'. It’s a bit more complex since an Entity can also be Taxonomy, File, User etc.

My current thoughts are a simple override in Entity API on storage retrieval there should be an Entity access check (e.g. if node) against the current domain so that only relevant Entities on that domain are retrieved. And only perform the check if DA module is present.

Thanks.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

That sounds like a query bug in the other module, which should be tagging it's query with 'node access'.

For non-node entities, there is no existing framework for access controls.

Tim Jones Toronto’s picture

Tim Jones Toronto commented

This behavior is happening in 3 independent Entity modules listed tested so far (I was giving one as an example to make things more clear etc.).

Will look into this further and get some feedback.

Thanks for now.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

If you link to the modules, I can take a look. Could be a security issue.

Tim Jones Toronto’s picture

Tim Jones Toronto commented

Thanks, two to look at are:

1. Entity Reference Field: http://drupal.org/project/ref_field
2. Entity Reference: http://drupal.org/project/entityreference

(Incidentally, these modules are pretty much identical in core functionality, there is discussion going on about this duplicate situation in issues for them).

I am double-checking http://drupal.org/project/relation as it seems to pass the node access rules for domains on the tests I am running. Will update.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

Neither modules has an official release, so we can discuss security issues in the open, I'm taking a look.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

I would expect to find the callback queries tagged properly:

->addTag('node_access')

EntityFieldReference does not contain that code at all. Neither does ref_field.

You should open issues for both modules or send private notes to the maintainers.

References does, but that's because it's code knows it is dealing with nodes. e.g.

/**
 * Value callback for a node_reference autocomplete element.
 *
 * Replace the node nid with a node title.
 */
function node_reference_autocomplete_value($element, $input = FALSE, $form_state) {
  if ($input === FALSE) {
    // We're building the displayed 'default value': expand the raw nid into
    // "node title [nid:n]".
    $nid = $element['#default_value'];
    if (!empty($nid)) {
      $q = db_select('node', 'n');
      $node_title_alias = $q->addField('n', 'title');
      $q->addTag('node_access')
        ->condition('n.nid', $nid)
        ->range(0, 1);
      $result = $q->execute();
      // @todo If no result (node doesn't exist or no access).
      $value = $result->fetchField();
      $value .= ' [nid:' . $nid . ']';
      return $value;
    }
  }
}

I'm not entirely certain how EntityField queries are handled. I know they should be tagged if you know they reference a field on a node entity.

So explaining this issue in the queue of either/both modules seems like a good place to start.

Tim Jones Toronto’s picture

Tim Jones Toronto commented

Thanks, and agree: References was created with node access specifically (addTag('node_access')) etc.

It's the new Entity stuff that needs a watchful eye on if to be compatible with Domain Access. I double checked Relation and it DOES work correctly with DA, so that's good news.

I have created an issue for Entity Reference Field to here, and will do the same for Entity Reference. And see any response.

Thanks again.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

Please post those issues here and close this one as a duplicate.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Active » Closed (works as designed)
mathieso’s picture

mathieso commented
Component: Code » Miscellaneous

Created a domain reference module, in the sandbox at http://drupal.org/sandbox/mathieso/1668578. Doesn't do all that a true entity reference would do, but useful in some situations.

Feedback welcome.

Kieran

Tim Jones Toronto’s picture

Tim Jones Toronto commented

@mathieso Great! Just what I need.

Have created an issue here: http://drupal.org/node/1671374