Without an 'access callback' defined on my entity type (which looking at the docs isn't even there...?), the UI page returns a 403 even for uid 1.

Comments

fago’s picture

Component: Entity CRUD API - UI » Documentation
Status: Active » Fixed

indeed, that one is required. Fixed the docs to mention that.

joachim’s picture

Component: Documentation » Entity CRUD API - UI
Status: Fixed » Needs review
StatusFileSize
new1.55 KB

I think this is a little clearer.

Status: Needs review » Needs work

The last submitted patch, 976360.entity.access-callback-required.patch, failed testing.

fago’s picture

Status: Needs work » Fixed

thanks, committed.

You'll need to use git diff --no-prefix for creating patches for d.o.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

acrazyanimal’s picture

Component: Entity property wrapper » Core integration
StatusFileSize
new1.8 KB

I believe there is also an inconsistency at play here in the implementation of the propertyAccess function in entity.wrapper.inc. At least with respect to how the other Entity API's access functions such as entityAccess and entity_access work. Those functions return NULL if an 'Access Callback' has not been set. This makes sense because then the caller can decide if NULL should be treated TRUE or FALSE in terms of granting access. However, propertyAccess assumes FALSE if its call to entityAccess returns NULL where it should probably just forward the result onward.

This affects rules access checking for certain entity related actions and in my case is preventing me from being able to use a VBO operation based on a rules component that uses the 'set data value' on an entity that does not specify an 'access callback'. I'm referencing the issue I've opened for rules here as well: #1526198: Default to TRUE if entity_access returns 'NULL'

Here is a patch to set it straight.

acrazyanimal’s picture

Component: Entity CRUD API - UI » Entity property wrapper
Status: Closed (fixed) » Needs review
mgifford’s picture

Component: Core integration » Entity property wrapper

Patch applies nicely. The logic's pretty simple. Ran it through Coder and there were no problems reported on the patch that was contributed.

fago’s picture

Status: Needs review » Needs work

Defaulting to NULL for propertAccess() if no entity access is defined makes sense to me. We should document it though why we are passing through $access + state this at docs of the access() method.

acrazyanimal’s picture

I would be happy to update the documentation when this get committed.

mgifford’s picture

@fago so that patch needs to be rebuilt to change the defaults for propertAccess().

acrazyanimal’s picture

Title: UI fails without 'access callback' defined » UI fails without 'access callback' defined [PATCH]
Status: Needs work » Needs review
StatusFileSize
new2.37 KB

@fago: Originally I thought you meant add to the documentation of the module, but looking back at your comment in #9 I realize you probably meant document the propertyAccess() function to explain in-line why we would pass $access through. So I have gone ahead and rebased against the latest dev and added some description to the function.

Does this work for you?

chris matthews’s picture

Issue summary: View changes
Status: Needs review » Needs work
Issue tags: +Needs reroll

The 6 year old patch in #12 to entity.wrapper.inc does not apply to the latest entity 7.x-1.x-dev.

entity-forward-entityAcces-in-propertyAccess-976360-9.patch:20: trailing whitespace.
   * 
Checking patch includes/entity.wrapper.inc...
error: while searching for:
    }
  }

  protected function propertyAccess($name, $op, $account = NULL) {
    $info = $this->getPropertyInfo($name);
    // If the property should be accessed and it's an entity, make sure the user
    // is allowed to view that entity.
    if ($op == 'view' && $this->$name instanceof EntityDrupalWrapper && !$this->$name->entityAccess($op, $account)) {
      return FALSE;
    }
    // If a property should be edited and this is an entity, make sure the user
    // has update access for this entity.

error: patch failed: includes/entity.wrapper.inc:498
error: includes/entity.wrapper.inc: patch does not apply
daiwik.addweb’s picture

StatusFileSize
new1.74 KB

@Chris Matthews, Here's the patch for the same, kindly share your feedback after using it. Thanks!.