If, using entity translation, I create a new translation of an FPP, but leave it unpublished, everyone can see this translation regardless of permissions.

CommentFileSizeAuthor
#1 1931678-fpp_unpublished_translation-1.patch961 bytesdalin
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

dalin’s picture

Assigned: dalin » Unassigned
Status: Active » Needs review
FileSize
961 bytes

entity_translation_field_language_alter() checks whether the user has access to a translation. It first calls $handler->getTranslations() to load all the translation data. In the case of FPP this returns:

stdClass::__set_state(array(
   'original' => NULL,
   'data' => 
  array (
  ),
));

Whereas for a node we have

stdClass::__set_state(array(
   'original' => 'en',
   'data' => 
  array (
    'en' => 
    array (
      'entity_type' => 'node',
      'entity_id' => '263',
      'language' => 'en',
      'source' => '',
      'uid' => '74',
      'status' => '1',
      'translate' => '0',
      'created' => '1360348216',
      'changed' => '1361389418',
    ),
    'fr' => 
    array (
      'entity_type' => 'node',
      'entity_id' => '263',
      'language' => 'fr',
      'source' => 'en',
      'uid' => '3',
      'status' => '0',
      'translate' => '0',
      'created' => '1362190606',
      'changed' => '1362190606',
    ),
  ),
));

Looking deeper the inconsistency happens in EntityTranslationDefaultHandler->getTranslations()

Since $this->entity->{$translations_key} is in fact set.

The attached patch overrides this method to instead check $this->entity->{$translations_key}->original
I'm not sure if this data actually needs to be added earlier in the process.

Status: Needs review » Needs work

The last submitted patch, 1931678-fpp_unpublished_translation-1.patch, failed testing.

merlinofchaos’s picture

Is this a side effect of entity caching? I can't think of any other reason that hook_entity_load would not be used.

DamienMcKenna’s picture

mglaman’s picture

dalin, can you provide testing instructions? Did you have Entity cache module enabled? Also, any chance this could have been a bug in Entity Translation itself?

dalin’s picture

90% chance that entity caching was in use on the site where I found the bug. But I have no idea what site I was working on at the time.

mglaman’s picture

I'm voting for taking this off of 1.6 release punch list, just because it might be "cannot reproduce" and was an entitycache bug or even in entity translation.

DamienMcKenna’s picture

Am taking this off the 1.6 list and it may in fact be a "by design" thing. FPPs don't have a status, so there's no way of marking one as being unpublished, so I suspect that's at play here.