1. class
  2. Drupal
  3. \
  4. jsonapi
  5. \
  6. Access
  7. \
  8. TemporaryQueryGuard

TemporaryQueryGuard

class TemporaryQueryGuard (View source)

internal  JSON:API maintains no PHP API. The API is the HTTP API. This class may change at any time and could break any dependencies on it.
 

Adds sufficient access control to collection queries.

This class will be removed when new Drupal core APIs have been put in place to make it obsolete.

These additional security measures should eventually reside in the Entity API subsystem but were introduced here to address a security vulnerability. The following two issues should obsolesce this class:

Properties

static protected EntityFieldManagerInterface $fieldManager

The entity field manager.
static protected ModuleHandlerInterface $moduleHandler

The module handler.

Methods

static 
setFieldManager(EntityFieldManagerInterface $field_manager)

Sets the entity field manager.

static 
setModuleHandler(ModuleHandlerInterface $module_handler)

Sets the module handler.

static 
applyAccessControls(Filter $filter, QueryInterface $query, CacheableMetadata $cacheability)

Applies access controls to an entity query.

static 
secureQuery(QueryInterface $query, string $entity_type_id, array $tree, CacheableMetadata $cacheability, string|null $field_prefix = NULL, FieldStorageDefinitionInterface $field_storage_definition = NULL)

Applies tags, metadata and conditions to secure an entity query.

static 
applyAccessConditions(QueryInterface $query, string $entity_type_id, string|null $field_prefix, CacheableMetadata $cacheability)

Applies access conditions to ensure 'view' access is respected.

static 
addConditionFieldPrefix(EntityConditionGroup $group, $field_prefix)

Prefixes all fields in an EntityConditionGroup.

static EntityConditionGroup|null
getAccessCondition(string $entity_type_id, CacheableMetadata $cacheability)

Gets an EntityConditionGroup that filters out inaccessible entities.

static EntityConditionGroup|null
getAccessConditionForKnownSubsets(EntityTypeInterface $entity_type, AccountInterface $account, CacheableMetadata $cacheability)

Gets an access condition for the allowed JSONAPI_FILTERAMONG* subsets.

static AccessResultInterface[]
getAccessResultsFromEntityFilterHook(EntityTypeInterface $entity_type, AccountInterface $account)

Gets the combined access result for each JSONAPI_FILTERAMONG* subset.

static EntityConditionGroup|null
getCommentAccessCondition(EntityTypeInterface $comment_entity_type, AccountInterface $current_user, CacheableMetadata $cacheability, int $depth = 1)

Gets an access condition for a comment entity.

static EntityConditionGroup
alwaysFalse(EntityTypeInterface $entity_type)

Gets an always FALSE entity condition group for the given entity type.

static array
collectFilteredFields(EntityConditionGroup $group, array $fields = [])

Recursively collects all entity query condition fields.

static 
buildTree(array $paths)

Copied from \Drupal\jsonapi\IncludeResolver.

Details

at line 62
static setFieldManager(EntityFieldManagerInterface $field_manager)

Sets the entity field manager.

This must be called before calling ::applyAccessControls().

Parameters

EntityFieldManagerInterface $field_manager

The entity field manager.

at line 74
static setModuleHandler(ModuleHandlerInterface $module_handler)

Sets the module handler.

This must be called before calling ::applyAccessControls().

Parameters

ModuleHandlerInterface $module_handler

The module handler.

at line 88
static applyAccessControls(Filter $filter, QueryInterface $query, CacheableMetadata $cacheability)

Applies access controls to an entity query.

Parameters

Filter $filter

The filters applicable to the query.
QueryInterface $query

The query to which access controls should be applied.
CacheableMetadata $cacheability

Collects cacheability for the query.

at line 122
static protected secureQuery(QueryInterface $query, string $entity_type_id, array $tree, CacheableMetadata $cacheability, string|null $field_prefix = NULL, FieldStorageDefinitionInterface $field_storage_definition = NULL)

Applies tags, metadata and conditions to secure an entity query.

Parameters

QueryInterface $query

The query to be secured.
string $entity_type_id

An entity type ID.
array $tree

A tree of field specifiers in an entity query condition. The tree is a multi-dimensional array where the keys are field specifiers and the values are multi-dimensional array of the same form, containing only subsequent specifiers. ::buildTree().
CacheableMetadata $cacheability

Collects cacheability for the query.
string|null $field_prefix

Internal use only. Contains a string representation of the previously visited field specifiers.
FieldStorageDefinitionInterface $field_storage_definition

Internal use only. The current field storage definition, if known.

See also

AlterableInterface::addTag
AlterableInterface::addMetaData
ConditionInterface

at line 197
static protected applyAccessConditions(QueryInterface $query, string $entity_type_id, string|null $field_prefix, CacheableMetadata $cacheability)

Applies access conditions to ensure 'view' access is respected.

Since the given entity type might not be the base entity type of the query, the field prefix should be applied to ensure that the conditions are applied to the right subset of entities in the query.

Parameters

QueryInterface $query

The query to which access conditions should be applied.
string $entity_type_id

The entity type for which to access conditions should be applied.
string|null $field_prefix

A prefix to add before any query condition fields. NULL if no prefix should be added.
CacheableMetadata $cacheability

Collects cacheability for the query.

at line 211
static protected addConditionFieldPrefix(EntityConditionGroup $group, $field_prefix)

Prefixes all fields in an EntityConditionGroup.

Parameters

EntityConditionGroup $group
$field_prefix

at line 237
static protected EntityConditionGroup|null getAccessCondition(string $entity_type_id, CacheableMetadata $cacheability)

Gets an EntityConditionGroup that filters out inaccessible entities.

Parameters

string $entity_type_id

The entity type ID for which to get an EntityConditionGroup.
CacheableMetadata $cacheability

Collects cacheability for the query.

Return Value

EntityConditionGroup|null

An EntityConditionGroup or NULL if no conditions need to be applied to secure an entity query.

at line 345
static protected EntityConditionGroup|null getAccessConditionForKnownSubsets(EntityTypeInterface $entity_type, AccountInterface $account, CacheableMetadata $cacheability)

Gets an access condition for the allowed JSONAPI_FILTERAMONG* subsets.

If access is allowed for the JSONAPI_FILTER_AMONG_ALL subset, then no conditions are returned. Otherwise, if access is allowed for JSONAPI_FILTER_AMONG_PUBLISHED, JSONAPI_FILTER_AMONG_ENABLED, or JSONAPI_FILTER_AMONG_OWN, then a condition group is returned for the union of allowed subsets. If no subsets are allowed, then static::alwaysFalse() is returned.

Parameters

EntityTypeInterface $entity_type

The entity type for which to check filter access.
AccountInterface $account

The account for which to check access.
CacheableMetadata $cacheability

Collects cacheability for the query.

Return Value

EntityConditionGroup|null

An EntityConditionGroup or NULL if no conditions need to be applied to secure an entity query.

at line 432
static protected AccessResultInterface[] getAccessResultsFromEntityFilterHook(EntityTypeInterface $entity_type, AccountInterface $account)

Gets the combined access result for each JSONAPI_FILTERAMONG* subset.

This invokes hook_jsonapi_entity_filter_access() and hook_jsonapi_ENTITY_TYPE_filter_access() and combines the results from all of the modules into a single set of results.

Parameters

EntityTypeInterface $entity_type

The entity type for which to check filter access.
AccountInterface $account

The account for which to check access.

Return Value

AccessResultInterface[]

The array of access results, keyed by subset. See hook_jsonapi_entity_filter_access() for details.

at line 482
static protected EntityConditionGroup|null getCommentAccessCondition(EntityTypeInterface $comment_entity_type, AccountInterface $current_user, CacheableMetadata $cacheability, int $depth = 1)

Gets an access condition for a comment entity.

Unlike all other core entity types, Comment entities' access control depends on access to a referenced entity. More challenging yet, that entity reference field may target different entity types depending on the comment bundle. This makes the query access conditions sufficiently complex to merit a dedicated method.

Parameters

EntityTypeInterface $comment_entity_type

The comment entity type object.
AccountInterface $current_user

The current user.
CacheableMetadata $cacheability

Collects cacheability for the query.
int $depth

Internal use only. The recursion depth. It is possible to have comments on comments, but since comment access is dependent on access to the entity on which they live, this method can recurse endlessly.

Return Value

EntityConditionGroup|null

An EntityConditionGroup or NULL if no conditions need to be applied to secure an entity query.

at line 547
static protected EntityConditionGroup alwaysFalse(EntityTypeInterface $entity_type)

Gets an always FALSE entity condition group for the given entity type.

Parameters

EntityTypeInterface $entity_type

The entity type for which to construct an impossible condition.

Return Value

EntityConditionGroup

An EntityConditionGroup which cannot evaluate to TRUE.

at line 568
static protected array collectFilteredFields(EntityConditionGroup $group, array $fields = [])

Recursively collects all entity query condition fields.

Entity conditions can be nested within AND and OR groups. This recursively finds all unique fields in an entity query condition.

Parameters

EntityConditionGroup $group

The root entity condition group.
array $fields

Internal use only.

Return Value

array

An array of entity query condition field names.

at line 585
static protected buildTree(array $paths)

Copied from \Drupal\jsonapi\IncludeResolver.

Parameters

array $paths

See also

IncludeResolver::buildTree