Skip to content

Commit 8e8e3d2

Browse files
xjmxjm
committed
SA-CORE-2021-009 by illeace, Wim Leers, xjm, effulgentsia, larowlan, pandaski, vijaycs85, phenaproxima, mcdruid
1 parent 634daa8 commit 8e8e3d2

File tree

7 files changed

+106
-51
lines changed

7 files changed

+106
-51
lines changed

‎modules/quickedit/src/MetadataGenerator.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public function generateFieldMetadata(FieldItemListInterface $items, $view_mode)
6868

6969
// Early-return if user does not have access.
7070
$access = $this->accessChecker->accessEditEntityField($entity, $field_name);
71-
if (!$access) {
71+
if (!$access->isAllowed()) {
7272
return ['access' => FALSE];
7373
}
7474

‎modules/quickedit/tests/modules/src/MockQuickEditEntityFieldAccessCheck.php

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace Drupal\quickedit_test;
44

5+
use Drupal\Core\Access\AccessResult;
56
use Drupal\Core\Entity\EntityInterface;
67
use Drupal\quickedit\Access\QuickEditEntityFieldAccessCheckInterface;
78

@@ -14,7 +15,19 @@ class MockQuickEditEntityFieldAccessCheck implements QuickEditEntityFieldAccessC
1415
* {@inheritdoc}
1516
*/
1617
public function accessEditEntityField(EntityInterface $entity, $field_name) {
17-
return TRUE;
18+
switch (\Drupal::state()->get('quickedit_test_field_access')) {
19+
case 'allowed':
20+
return AccessResult::allowed();
21+
22+
case 'neutral':
23+
return AccessResult::neutral();
24+
25+
case 'forbidden':
26+
return AccessResult::forbidden();
27+
28+
default:
29+
throw new \OutOfRangeException("The state for the 'quickedit_test_field_access' key must be either 'allowed', 'neutral' or 'forbidden'.");
30+
}
1831
}
1932

2033
}

‎modules/quickedit/tests/src/FunctionalJavascript/LayoutBuilderQuickEditTest.php

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,14 @@ public function testQuickEditIgnoresDuplicateFields() {
112112

113113
$this->drupalLogin($this->contentAuthorUser);
114114
$this->usingLayoutBuilder = TRUE;
115+
$this->assertQuickEditInit(['title']);
116+
$this->drupalLogin($this->drupalCreateUser([
117+
'access contextual links',
118+
'access in-place editing',
119+
'access content',
120+
'edit any article content',
121+
'administer nodes',
122+
]));
115123
$this->assertQuickEditInit(['title', 'uid', 'created']);
116124
}
117125

@@ -123,18 +131,26 @@ public function testQuickEditIgnoresDuplicateFields() {
123131
*
124132
* @dataProvider providerEnableDisableLayoutBuilder
125133
*/
126-
public function testEnableDisableLayoutBuilder($use_revisions) {
134+
public function testEnableDisableLayoutBuilder($use_revisions, $admin_permission = FALSE) {
127135
if (!$use_revisions) {
128136
$content_type = NodeType::load('article');
129137
$content_type->setNewRevision(FALSE);
130138
$content_type->save();
131139
}
132140
$fields = [
133141
'title',
134-
'uid',
135-
'created',
136142
'body',
137143
];
144+
if ($admin_permission) {
145+
$fields = array_merge($fields, ['uid', 'created']);
146+
$this->drupalLogin($this->drupalCreateUser([
147+
'access contextual links',
148+
'access in-place editing',
149+
'access content',
150+
'edit any article content',
151+
'administer nodes',
152+
]));
153+
}
138154

139155
// Test article with Layout Builder disabled.
140156
$this->assertQuickEditInit($fields);
@@ -168,8 +184,10 @@ public function testEnableDisableLayoutBuilder($use_revisions) {
168184
*/
169185
public function providerEnableDisableLayoutBuilder() {
170186
return [
171-
'use revisions' => [TRUE],
172-
'do not use revisions' => [FALSE],
187+
'use revisions, not admin' => [TRUE],
188+
'do not use revisions, not admin' => [FALSE],
189+
'use revisions, admin' => [TRUE, TRUE],
190+
'do not use revisions, admin' => [FALSE, TRUE],
173191
];
174192
}
175193

‎modules/quickedit/tests/src/FunctionalJavascript/QuickEditImageTest.php

Lines changed: 48 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -41,27 +41,32 @@ protected function setUp(): void {
4141

4242
// Create the Article node type.
4343
$this->drupalCreateContentType(['type' => 'article', 'name' => 'Article']);
44+
}
4445

46+
/**
47+
* Tests that quick editor works correctly with images.
48+
*
49+
* @covers ::isCompatible
50+
* @covers ::getAttachments
51+
*
52+
* @dataProvider providerTestImageInPlaceEditor
53+
*/
54+
public function testImageInPlaceEditor($admin_permission = FALSE) {
4555
// Log in as a content author who can use Quick Edit and edit Articles.
46-
$this->contentAuthorUser = $this->drupalCreateUser([
56+
$permissions = [
4757
'access contextual links',
4858
'access toolbar',
4959
'access in-place editing',
5060
'access content',
5161
'create article content',
5262
'edit any article content',
5363
'delete any article content',
54-
]);
64+
];
65+
if ($admin_permission) {
66+
$permissions[] = 'administer nodes';
67+
}
68+
$this->contentAuthorUser = $this->drupalCreateUser($permissions);
5569
$this->drupalLogin($this->contentAuthorUser);
56-
}
57-
58-
/**
59-
* Tests that quick editor works correctly with images.
60-
*
61-
* @covers ::isCompatible
62-
* @covers ::getAttachments
63-
*/
64-
public function testImageInPlaceEditor() {
6570
// Create a field with a basic filetype restriction.
6671
$field_name = strtolower($this->randomMachineName());
6772
$field_settings = [
@@ -126,13 +131,25 @@ public function testImageInPlaceEditor() {
126131
$this->assertEntityInstanceStates([
127132
'node/1[0]' => 'closed',
128133
]);
134+
135+
$admin_inactive = [];
136+
$admin_candidate = [];
137+
if ($admin_permission) {
138+
$admin_inactive = [
139+
'node/1/uid/en/full' => 'inactive',
140+
'node/1/created/en/full' => 'inactive',
141+
];
142+
$admin_candidate = [
143+
'node/1/uid/en/full' => 'candidate',
144+
'node/1/created/en/full' => 'candidate',
145+
];
146+
}
147+
129148
$this->assertEntityInstanceFieldStates('node', 1, 0, [
130149
'node/1/title/en/full' => 'inactive',
131-
'node/1/uid/en/full' => 'inactive',
132-
'node/1/created/en/full' => 'inactive',
133150
'node/1/body/en/full' => 'inactive',
134151
'node/1/' . $field_name . '/en/full' => 'inactive',
135-
]);
152+
] + $admin_inactive);
136153

137154
// Start in-place editing of the article node.
138155
$this->startQuickEditViaToolbar('node', 1, 0);
@@ -142,33 +159,27 @@ public function testImageInPlaceEditor() {
142159
$this->assertQuickEditEntityToolbar((string) $node->label(), NULL);
143160
$this->assertEntityInstanceFieldStates('node', 1, 0, [
144161
'node/1/title/en/full' => 'candidate',
145-
'node/1/uid/en/full' => 'candidate',
146-
'node/1/created/en/full' => 'candidate',
147162
'node/1/body/en/full' => 'candidate',
148163
'node/1/' . $field_name . '/en/full' => 'candidate',
149-
]);
164+
] + $admin_candidate);
150165

151166
// Click the image field.
152167
$this->click($field_selector);
153168
$this->awaitImageEditor();
154169
$this->assertSession()->elementExists('css', $field_selector . ' .quickedit-image-dropzone');
155170
$this->assertEntityInstanceFieldStates('node', 1, 0, [
156171
'node/1/title/en/full' => 'candidate',
157-
'node/1/uid/en/full' => 'candidate',
158-
'node/1/created/en/full' => 'candidate',
159172
'node/1/body/en/full' => 'candidate',
160173
'node/1/' . $field_name . '/en/full' => 'active',
161-
]);
174+
] + $admin_candidate);
162175

163176
// Type new 'alt' text.
164177
$this->typeInImageEditorAltTextInput('New text');
165178
$this->assertEntityInstanceFieldStates('node', 1, 0, [
166179
'node/1/title/en/full' => 'candidate',
167-
'node/1/uid/en/full' => 'candidate',
168-
'node/1/created/en/full' => 'candidate',
169180
'node/1/body/en/full' => 'candidate',
170181
'node/1/' . $field_name . '/en/full' => 'changed',
171-
]);
182+
] + $admin_candidate);
172183

173184
// Drag and drop an image.
174185
$this->dropImageOnImageEditor($valid_images[1]->uri);
@@ -184,11 +195,9 @@ public function testImageInPlaceEditor() {
184195
]);
185196
$this->assertEntityInstanceFieldStates('node', 1, 0, [
186197
'node/1/title/en/full' => 'candidate',
187-
'node/1/uid/en/full' => 'candidate',
188-
'node/1/created/en/full' => 'candidate',
189198
'node/1/body/en/full' => 'candidate',
190199
'node/1/' . $field_name . '/en/full' => 'saving',
191-
]);
200+
] + $admin_candidate);
192201
$this->assertEntityInstanceFieldMarkup([
193202
'node/1/' . $field_name . '/en/full' => '.quickedit-changed',
194203
]);
@@ -208,4 +217,17 @@ public function testImageInPlaceEditor() {
208217
$this->assertSession()->elementExists('css', $entity_selector . ' ' . $field_selector . ' ' . $new_image_selector);
209218
}
210219

220+
/**
221+
* Data provider for ::testImageInPlaceEditor().
222+
*
223+
* @return array
224+
* Test cases.
225+
*/
226+
public function providerTestImageInPlaceEditor(): array {
227+
return [
228+
'with permission' => [TRUE],
229+
'without permission' => [FALSE],
230+
];
231+
}
232+
211233
}

‎modules/quickedit/tests/src/FunctionalJavascript/QuickEditIntegrationTest.php

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,6 @@ public function testArticleNode() {
146146
]);
147147
$this->assertEntityInstanceFieldStates('node', 1, 0, [
148148
'node/1/title/en/full' => 'inactive',
149-
'node/1/uid/en/full' => 'inactive',
150-
'node/1/created/en/full' => 'inactive',
151149
'node/1/body/en/full' => 'inactive',
152150
'node/1/field_tags/en/full' => 'inactive',
153151
]);
@@ -160,8 +158,6 @@ public function testArticleNode() {
160158
$this->assertQuickEditEntityToolbar((string) $node->label(), NULL);
161159
$this->assertEntityInstanceFieldStates('node', 1, 0, [
162160
'node/1/title/en/full' => 'candidate',
163-
'node/1/uid/en/full' => 'candidate',
164-
'node/1/created/en/full' => 'candidate',
165161
'node/1/body/en/full' => 'candidate',
166162
'node/1/field_tags/en/full' => 'candidate',
167163
]);
@@ -174,8 +170,6 @@ public function testArticleNode() {
174170
$this->assertQuickEditEntityToolbar((string) $node->label(), 'Title');
175171
$this->assertEntityInstanceFieldStates('node', 1, 0, [
176172
'node/1/title/en/full' => 'active',
177-
'node/1/uid/en/full' => 'candidate',
178-
'node/1/created/en/full' => 'candidate',
179173
'node/1/body/en/full' => 'candidate',
180174
'node/1/field_tags/en/full' => 'candidate',
181175
]);
@@ -188,8 +182,6 @@ public function testArticleNode() {
188182
$this->awaitEntityInstanceFieldState('node', 1, 0, 'title', 'en', 'changed');
189183
$this->assertEntityInstanceFieldStates('node', 1, 0, [
190184
'node/1/title/en/full' => 'changed',
191-
'node/1/uid/en/full' => 'candidate',
192-
'node/1/created/en/full' => 'candidate',
193185
'node/1/body/en/full' => 'candidate',
194186
'node/1/field_tags/en/full' => 'candidate',
195187
]);
@@ -201,8 +193,6 @@ public function testArticleNode() {
201193
$this->assertQuickEditEntityToolbar((string) $node->label(), 'Body');
202194
$this->assertEntityInstanceFieldStates('node', 1, 0, [
203195
'node/1/title/en/full' => 'saving',
204-
'node/1/uid/en/full' => 'candidate',
205-
'node/1/created/en/full' => 'candidate',
206196
'node/1/body/en/full' => 'active',
207197
'node/1/field_tags/en/full' => 'candidate',
208198
]);
@@ -223,8 +213,6 @@ public function testArticleNode() {
223213
$assert_session->waitForElement('css', '.quickedit-toolbar-field div[id*="tags"]');
224214
$this->assertQuickEditEntityToolbar((string) $node->label(), 'Tags');
225215
$this->assertEntityInstanceFieldStates('node', 1, 0, [
226-
'node/1/uid/en/full' => 'candidate',
227-
'node/1/created/en/full' => 'candidate',
228216
'node/1/body/en/full' => 'candidate',
229217
'node/1/field_tags/en/full' => 'activating',
230218
'node/1/title/en/full' => 'candidate',
@@ -239,8 +227,6 @@ public function testArticleNode() {
239227
// Wait for the form to load.
240228
$this->assertJsCondition('document.querySelector(\'.quickedit-form-container > .quickedit-form[role="dialog"] > .placeholder\') === null');
241229
$this->assertEntityInstanceFieldStates('node', 1, 0, [
242-
'node/1/uid/en/full' => 'candidate',
243-
'node/1/created/en/full' => 'candidate',
244230
'node/1/body/en/full' => 'candidate',
245231
'node/1/field_tags/en/full' => 'active',
246232
'node/1/title/en/full' => 'candidate',
@@ -250,8 +236,6 @@ public function testArticleNode() {
250236
$this->typeInFormEditorTextInputField('field_tags[target_id]', 'foo, bar');
251237
$this->awaitEntityInstanceFieldState('node', 1, 0, 'field_tags', 'en', 'changed');
252238
$this->assertEntityInstanceFieldStates('node', 1, 0, [
253-
'node/1/uid/en/full' => 'candidate',
254-
'node/1/created/en/full' => 'candidate',
255239
'node/1/body/en/full' => 'candidate',
256240
'node/1/field_tags/en/full' => 'changed',
257241
'node/1/title/en/full' => 'candidate',
@@ -264,8 +248,6 @@ public function testArticleNode() {
264248
'node/1[0]' => 'committing',
265249
]);
266250
$this->assertEntityInstanceFieldStates('node', 1, 0, [
267-
'node/1/uid/en/full' => 'candidate',
268-
'node/1/created/en/full' => 'candidate',
269251
'node/1/body/en/full' => 'candidate',
270252
'node/1/field_tags/en/full' => 'saving',
271253
'node/1/title/en/full' => 'candidate',

‎modules/quickedit/tests/src/Kernel/EditorIntegrationTest.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,11 @@ public function testMetadata() {
179179

180180
// Verify metadata.
181181
$items = $entity->get($this->fieldName);
182+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
183+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
184+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
185+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
186+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
182187
$metadata = $this->metadataGenerator->generateFieldMetadata($items, 'default');
183188
$expected = [
184189
'access' => TRUE,

‎modules/quickedit/tests/src/Kernel/MetadataGeneratorTest.php

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,11 @@ public function testSimpleEntityType() {
9797

9898
// Verify metadata for field 1.
9999
$items_1 = $entity->get($field_1_name);
100+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
101+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_1, 'default'));
102+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
103+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_1, 'default'));
104+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
100105
$metadata_1 = $this->metadataGenerator->generateFieldMetadata($items_1, 'default');
101106
$expected_1 = [
102107
'access' => TRUE,
@@ -107,6 +112,11 @@ public function testSimpleEntityType() {
107112

108113
// Verify metadata for field 2.
109114
$items_2 = $entity->get($field_2_name);
115+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
116+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_2, 'default'));
117+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
118+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_2, 'default'));
119+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
110120
$metadata_2 = $this->metadataGenerator->generateFieldMetadata($items_2, 'default');
111121
$expected_2 = [
112122
'access' => TRUE,
@@ -163,6 +173,11 @@ public function testEditorWithCustomMetadata() {
163173

164174
// Verify metadata.
165175
$items = $entity->get($field_name);
176+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
177+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
178+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
179+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
180+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
166181
$metadata = $this->metadataGenerator->generateFieldMetadata($items, 'default');
167182
$expected = [
168183
'access' => TRUE,

0 commit comments

Comments
 (0)