diff --git a/core/includes/entity.inc b/core/includes/entity.inc index fe30114..2b3885e 100644 --- a/core/includes/entity.inc +++ b/core/includes/entity.inc @@ -865,21 +865,11 @@ function entity_page_access(EntityInterface $entity, $operation = 'view') { * The entity type. * @param string $bundle * (optional) The bundle of the entity. Required if the entity supports - * bundles, defaults to the entity type otherwise. + * bundles, defaults to NULL otherwise. * * @return bool * TRUE if the access is granted. FALSE if access is denied. */ function entity_page_create_access($entity_type, $bundle = NULL) { - $definition = Drupal::entityManager()->getDefinition($entity_type); - - // Pass in the entity bundle if given and required. - $values = array(); - if ($bundle && isset($definition['entity_keys']['bundle'])) { - $values[$definition['entity_keys']['bundle']] = $bundle; - } - $entity = Drupal::entityManager() - ->getStorageController($entity_type) - ->create($values); - return $entity->access('create'); + return Drupal::entityManager()->getAccessController($entity_type)->createAccess($bundle); } diff --git a/core/lib/Drupal/Core/Entity/EntityAccessController.php b/core/lib/Drupal/Core/Entity/EntityAccessController.php index a328443..32e81f1 100644 --- a/core/lib/Drupal/Core/Entity/EntityAccessController.php +++ b/core/lib/Drupal/Core/Entity/EntityAccessController.php @@ -23,14 +23,27 @@ class EntityAccessController implements EntityAccessControllerInterface { protected $accessCache = array(); /** + * The entity type of the access controller instance. + * + * @var string + */ + protected $entityType; + + /** + * @param string $entity_type + * The entity type of the access controller instance. + */ + public function __construct($entity_type) { + $this->entity_type = $entity_type; + } + + /** * {@inheritdoc} */ public function access(EntityInterface $entity, $operation, $langcode = Language::LANGCODE_DEFAULT, AccountInterface $account = NULL) { - if (!$account) { - $account = $GLOBALS['user']; - } + $this->prepareUser($account); - if (($access = $this->getCache($entity, $operation, $langcode, $account)) !== NULL) { + if (($access = $this->getCache($entity->uuid(), $operation, $langcode, $account)) !== NULL) { // Cache hit, no work necessary. return $access; } @@ -45,17 +58,36 @@ public function access(EntityInterface $entity, $operation, $langcode = Language // - At least one module says to grant access. $access = module_invoke_all($entity->entityType() . '_access', $entity->getBCEntity(), $operation, $account, $langcode); + if ($return = $this->processAccessHookResults($access) === NULL) { + // No module had an opinion about the access, so let's the access + // controller check create access. + $return = (bool) $this->checkAccess($entity, $operation, $langcode, $account); + } + return $this->setCache($return, $entity->uuid(), $operation, $langcode, $account); + } + + /** + * We grant access to the entity if both of these conditions are met: + * - No modules say to deny access. + * - At least one module says to grant access. + * + * @param array $access + * An array of access results of the fired access hook. + * + * @return bool|NULL + * Returns FALSE if access should be denied, TRUE if access should be + * granted and NULL if no module denied access. + */ + protected function processAccessHookResults(array $access) { if (in_array(FALSE, $access, TRUE)) { - $return = FALSE; + return FALSE; } elseif (in_array(TRUE, $access, TRUE)) { - $return = TRUE; + return TRUE; } else { - // No result from hook, so entity checks are done. - $return = (bool) $this->checkAccess($entity, $operation, $langcode, $account); + return; } - return $this->setCache($return, $entity, $operation, $langcode, $account); } /** @@ -85,8 +117,9 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A /** * Tries to retrieve a previously cached access value from the static cache. * - * @param \Drupal\Core\Entity\EntityInterface $entity - * The entity for which to check 'create' access. + * @param string $cid + * Unique string identifier for the entity/operation, for example the + * entity UUID or a custom string. * @param string $operation * The entity operation. Usually one of 'view', 'update', 'create' or * 'delete'. @@ -100,13 +133,12 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A * is no record for the given user, operation, langcode and entity in the * cache. */ - protected function getCache(EntityInterface $entity, $operation, $langcode, AccountInterface $account) { + protected function getCache($cid, $operation, $langcode, AccountInterface $account) { $uid = $account ? $account->id() : 0; - $uuid = $entity->uuid(); // Return from cache if a value has been set for it previously. - if (isset($this->accessCache[$uid][$uuid][$langcode][$operation])) { - return $this->accessCache[$uid][$uuid][$langcode][$operation]; + if (isset($this->accessCache[$uid][$cid][$langcode][$operation])) { + return $this->accessCache[$uid][$cid][$langcode][$operation]; } } @@ -115,8 +147,9 @@ protected function getCache(EntityInterface $entity, $operation, $langcode, Acco * * @param bool $access * TRUE if the user has access, FALSE otherwise. - * @param \Drupal\Core\Entity\EntityInterface $entity - * The entity for which to check 'create' access. + * @param string $cid + * Unique string identifier for the entity/operation, for example the + * entity UUID or a custom string. * @param string $operation * The entity operation. Usually one of 'view', 'update', 'create' or * 'delete'. @@ -128,12 +161,11 @@ protected function getCache(EntityInterface $entity, $operation, $langcode, Acco * @return bool * TRUE if access was granted, FALSE otherwise. */ - protected function setCache($access, EntityInterface $entity, $operation, $langcode, AccountInterface $account) { + protected function setCache($access, $cid, $operation, $langcode, AccountInterface $account) { $uid = $account ? $account->id() : 0; - $uuid = $entity->uuid(); // Save the given value in the static cache and directly return it. - return $this->accessCache[$uid][$uuid][$langcode][$operation] = (bool) $access; + return $this->accessCache[$uid][$cid][$langcode][$operation] = (bool) $access; } /** @@ -143,4 +175,75 @@ public function resetCache() { $this->accessCache = array(); } + /** + * {@inheritdoc} + */ + public function createAccess($entity_bundle = NULL, AccountInterface $account = NULL, $context = array()) { + $account = $this->prepareUser($account); + $context += array( + 'langcode' => Language::LANGCODE_DEFAULT, + ); + + $cid = $entity_bundle ? 'create:' . $entity_bundle : 'create'; + if (($access = $this->getCache($cid, 'create', $context['langcode'], $account)) !== NULL) { + // Cache hit, no work necessary. + return $access; + } + + // Invoke hook_entity_access(), hook results take precedence over overridden + // implementations of EntityAccessController::checkAccess(). Entities + // that have checks that need to be done before the hook is invoked should + // do so by overridding this method. + + // We grant access to the entity if both of these conditions are met: + // - No modules say to deny access. + // - At least one module says to grant access. + $access = module_invoke_all($this->entity_type . '_create_access', $account, $context['langcode']); + + if ($return = $this->processAccessHookResults($access) === NULL) { + // No module had an opinion about the access, so let's the access + // controller check create access. + $return = (bool) $this->checkCreateAccess($account, $context, $entity_bundle = NULL); + } + return $this->setCache($return, $cid, 'create', $context['langcode'], $account); + } + + /** + * Performs create access checks. + * + * This method is supposed to be overwritten by extending classes that + * do their own custom access checking. + * + * @param \Drupal\Core\Session\AccountInterface $account + * The user for which to check access. + * @param array $context + * An array of key-value pairs to pass additional context when needed. + * @param string|null $entity_bundle + * (optional) The bundle of the entity. Required if the entity supports + * bundles, defaults to NULL otherwise. + * + * @return bool|null + * TRUE if access was granted, FALSE if access was denied and NULL if access + * could not be determined. + */ + protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) { + return NULL; + } + + /** + * Loads the current account object, if it does not exist yet. + * + * @param \Drupal\Core\Session\AccountInterface $account + * The account interface instance. + * + * @return \Drupal\Core\Session\AccountInterface + * Returns the current account object. + */ + protected function prepareUser(AccountInterface $account = NULL) { + if (!$account) { + $account = $GLOBALS['user']; + } + return $account; + } + } diff --git a/core/lib/Drupal/Core/Entity/EntityAccessControllerInterface.php b/core/lib/Drupal/Core/Entity/EntityAccessControllerInterface.php index f7b4348..c8c77c1 100644 --- a/core/lib/Drupal/Core/Entity/EntityAccessControllerInterface.php +++ b/core/lib/Drupal/Core/Entity/EntityAccessControllerInterface.php @@ -36,6 +36,20 @@ public function access(EntityInterface $entity, $operation, $langcode = Language::LANGCODE_DEFAULT, AccountInterface $account = NULL); /** + * Checks access to create an entity. + * + * @param string $entity_bundle + * (optional) The bundle of the entity. Required if the entity supports + * bundles, defaults to NULL otherwise. + * @param \Drupal\Core\Session\AccountInterface $account + * (optional) The user session for which to check access, or NULL to check + * access for the current user. Defaults to NULL. + * @param array $context + * An array of key-value pairs to pass additional context when needed. + */ + public function createAccess($entity_bundle = NULL, AccountInterface $account = NULL, $context = array()); + + /** * Clears all cached access checks. */ public function resetCache(); diff --git a/core/modules/node/lib/Drupal/node/NodeAccessController.php b/core/modules/node/lib/Drupal/node/NodeAccessController.php index e36743e..8d976ee 100644 --- a/core/modules/node/lib/Drupal/node/NodeAccessController.php +++ b/core/modules/node/lib/Drupal/node/NodeAccessController.php @@ -34,6 +34,35 @@ public function access(EntityInterface $entity, $operation, $langcode = Language /** * {@inheritdoc} */ + public function createAccess($entity_bundle = NULL, AccountInterface $account = NULL, $context = array()) { + $account = $this->prepareUser($account); + + if (user_access('bypass node access', $account)) { + return TRUE; + } + if (!user_access('access content', $account)) { + return FALSE; + } + + $access = module_invoke_all('node_create_access', $account, $context); + + $configured_types = node_permissions_get_configured_types(); + if (isset($configured_types[$entity_bundle])) { + if (user_access('create ' . $entity_bundle . ' content', $account)) { + $access[] = NODE_ACCESS_ALLOW; + } + } + + if ($return = $this->processAccessHookResults($access) !== NULL) { + return $return; + } + + return NODE_ACCESS_DENY; + } + + /** + * {@inheritdoc} + */ protected function checkAccess(EntityInterface $node, $operation, $langcode, AccountInterface $account) { // Fetch information from the node object if possible. $status = isset($node->status) ? $node->status : NULL; diff --git a/core/modules/node/node.module b/core/modules/node/node.module index b9c5bd3..33c0379 100644 --- a/core/modules/node/node.module +++ b/core/modules/node/node.module @@ -2155,37 +2155,42 @@ function node_form_system_themes_admin_form_submit($form, &$form_state) { * @see node_menu() */ function node_access($op, $node, $account = NULL, $langcode = NULL) { - if (!$node instanceof EntityInterface) { - $node = entity_create('node', array('type' => $node)); - } - elseif ($node instanceof NodeTypeInterface) { - $node = entity_create('node', array('type' => $node->id())); + $access_controller = Drupal::entityManager()->getAccessController('node'); + + if ($op == 'create') { + if (!$node instanceof EntityInterface) { + $bundle = $node; + } + elseif ($node instanceof NodeTypeInterface) { + $bundle = $node->id(); + } } - // If no language code was provided, default to the node's langcode. - if (empty($langcode)) { - $langcode = $node->langcode; - // If the Language module is enabled, try to use the language from content - // negotiation. - if (module_exists('language')) { - // Load languages the node exists in. - $node_translations = $node->getTranslationLanguages(); - // Load the language from content negotiation. - $content_negotiation_langcode = language(Language::TYPE_CONTENT)->id; - // If there is a translation available, use it. - if (isset($node_translations[$content_negotiation_langcode])) { - $langcode = $content_negotiation_langcode; + else { + // If no language code was provided, default to the node's langcode. + if (empty($langcode)) { + $langcode = $node->langcode; + // If the Language module is enabled, try to use the language from content + // negotiation. + if (module_exists('language')) { + // Load languages the node exists in. + $node_translations = $node->getTranslationLanguages(); + // Load the language from content negotiation. + $content_negotiation_langcode = language(Language::TYPE_CONTENT)->id; + // If there is a translation available, use it. + if (isset($node_translations[$content_negotiation_langcode])) { + $langcode = $content_negotiation_langcode; + } } } } - // Make sure that if an account is passed, that it is a fully loaded user - // object. - if ($account && !($account instanceof UserInterface)) { - $account = user_load($account->uid); + if ($op == 'create') { + return $access_controller->createAccess($bundle, $langcode, $account); + } + else { + return $access_controller->access($node, $op, $langcode, $account); } - - return entity_access_controller('node')->access($node, $op, $langcode, $account); } /** diff --git a/core/modules/translation/translation.module b/core/modules/translation/translation.module index 9c88847..95dbd9f 100644 --- a/core/modules/translation/translation.module +++ b/core/modules/translation/translation.module @@ -121,14 +121,14 @@ function translation_permission() { } /** - * Implements hook_node_access(). + * Implements hook_node_create_access(). */ -function translation_node_access($node, $op, $account, $langcode) { +function translation_node_create_access($account) { $query = Drupal::request()->query; $translation = $query->get('translation'); $target = $query->get('target'); $request_has_translation_arg = !empty($translation) && !empty($target) && is_numeric($translation); - if ($op == 'create' && $request_has_translation_arg) { + if ($request_has_translation_arg) { $source_node = node_load($translation); if (empty($source_node) || !translation_user_can_translate_node($source_node, $account)){ return NODE_ACCESS_DENY;