Follow up for 4. in #1658846-187: Add language support to node access grants and records

Problem/Motivation

If some hook implementation defines a langcode, but language is off or the language is not enabled, it looks like this would blow up.

Proposed resolution

If some hook implementation defines a langcode, but language is off or the language is not enabled, it looks like this would blow up. Did I say that already and ask for a test for it? Edit: No, I think I said maybe it was on the contrib module to add language to its requirements. However, let's make sure we document that somehow, somewhere. If you execute a db_insert() with no values, does it simply insert no records, or does it fail? Can someone test this?

Remaining tasks

  • Find out what happens when execute a db_insert() with no values. Does it simply insert no records, or does it fail?
  • Add comments to the code to document what happens.
  • Add the test for if a module has some hook implementation defining a langcode when language is not enabled. See contributor task document for writing tests: http://drupal.org/node/1468170

User interface changes

No UI changes.

API changes

No API changes.

Original report by @xjm

In 4. in #1658846-187: Add language support to node access grants and records

+++ b/core/modules/node/node.moduleundefined
@@ -3036,18 +3077,35 @@ function _node_access_write_grants(Node $node, $grants, $realm = NULL, $delete =
+      if (isset($grant['langcode'])) {
+        $grant_languages = array($grant['langcode'] => language_load($grant['langcode']));
+      }
+      else {
+        $grant_languages = $node->getTranslationLanguages(TRUE);
+      }
+      foreach ($grant_languages as $grant_langcode => $grant_language) {
+        // Only write grants; denies are implicit.
+        if ($grant['grant_view'] || $grant['grant_update'] || $grant['grant_delete']) {
+          $grant['nid'] = $node->nid;
+          $grant['langcode'] = $grant_langcode;
+          // The record with the original langcode is used as the fallback.
+          if ($grant['langcode'] == $node->langcode) {
+            $grant['fallback'] = 1;
+          }
+          else {
+            $grant['fallback'] = 0;
+          }
+          $query->values($grant);
+        }

If some hook implementation defines a langcode, but language is off or the language is not enabled, it looks like this would blow up. Did I say that already and ask for a test for it? Edit: No, I think I said maybe it was on the contrib module to add language to its requirements. However, let's make sure we document that somehow, somewhere. If you execute a db_insert() with no values, does it simply insert no records, or does it fail? Can someone test this?

Comments

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

Status: Active » Postponed (maintainer needs more info)
Issue tags: +stale-issue-cleanup

Thank you for creating this issue to improve Drupal.

We are working to decide if this task is still relevant to a currently supported version of Drupal. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or is no longer relevant. Your thoughts on this will allow a decision to be made.

Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Thanks!

acbramley’s picture

Status: Postponed (maintainer needs more info) » Closed (outdated)

I've looked at the code (now lives in NodeGrantDatabaseStorage::write) and I can't see how it would "blow up". Given the age of this issue and lack of activity I'm going to close it for now.

xjm’s picture

Title: Add a test for a hook implementation that defines a langcode but language module is not enabled. » Add a test for a hook implementation that defines a langcode but the language is not enabled (or is disabled and then re-enabled)
Assigned: Unassigned » xjm
Status: Closed (outdated) » Active

The code is still essentially the same, so I should probably try to determine what I was talking about in my review of #1658846-187: Add language support to node access grants and records twelve years ago. The problem that I believe I was talking about was the following codepath:

if (isset($grant['langcode'])) {
        $grant_languages = array($grant['langcode'] => language_load($grant['langcode']));
 }

...in the scenario where the Language module or the language in question was not currently available on the site.

language_load() not defined ➡️ fatal. This potential problem may no longer be relevant with post-release Drupal 8 now that the language manager might always be available? At a minimum, it's no longer going to fatal.

Language not currently available on site ➡️ an array [$langcode => NULL]. Then the foreach would set it to a null langcode, instead of what it started as. Edit: Never mind, mis-read the part of the code; it doesn't care about the actual language object. In fact, it looks like I might also have mis-read it in the same way in 2013 at BADCamp or Sydney or wherever I was when I first reviewed that part of the patch. Really it should just do a foreach(array_keys()), honestly.

Anyway, that's the part I was asking for test coverage for, because this could potentially cause strange things for site owner expectations if translation is disabled and then re-enabled, for example, if the contrib or custom node access implementation provides or alters in langcodes. Edit: including resiliency and not-data-loss-or-access-bypasses if it wasn't properly declaring dependencies on the language. (See for example SA-CORE-2018-001 for why we have to be careful about stuff like that.)

xjm’s picture

Assigned: xjm » Unassigned

Was going to assign it to myself to explain later but then ended up explaining it now.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.