Skip to content

Commit f7d766b

Browse files
xjmxjm
committed
SA-CORE-2021-009 by illeace, Wim Leers, xjm, effulgentsia, larowlan, pandaski, vijaycs85, phenaproxima, mcdruid
1 parent ba2b781 commit f7d766b

File tree

7 files changed

+106
-50
lines changed

7 files changed

+106
-50
lines changed

‎modules/editor/tests/src/Kernel/QuickEditIntegrationTest.php

+5
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,11 @@ public function testMetadata() {
180180

181181
// Verify metadata.
182182
$items = $entity->get($this->fieldName);
183+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
184+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
185+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
186+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
187+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
183188
$metadata = $this->metadataGenerator->generateFieldMetadata($items, 'default');
184189
$expected = [
185190
'access' => TRUE,

‎modules/image/tests/src/FunctionalJavascript/QuickEditImageTest.php

+48-25
Original file line numberDiff line numberDiff line change
@@ -42,27 +42,33 @@ protected function setUp() {
4242

4343
// Create the Article node type.
4444
$this->drupalCreateContentType(['type' => 'article', 'name' => 'Article']);
45+
}
4546

47+
/**
48+
* Tests that quick editor works correctly with images.
49+
*
50+
* @covers ::isCompatible
51+
* @covers ::getAttachments
52+
*
53+
* @dataProvider providerTestImageInPlaceEditor
54+
*/
55+
public function testImageInPlaceEditor($admin_permission = FALSE) {
4656
// Log in as a content author who can use Quick Edit and edit Articles.
47-
$this->contentAuthorUser = $this->drupalCreateUser([
57+
$permissions = [
4858
'access contextual links',
4959
'access toolbar',
5060
'access in-place editing',
5161
'access content',
5262
'create article content',
5363
'edit any article content',
5464
'delete any article content',
55-
]);
65+
];
66+
if ($admin_permission) {
67+
$permissions[] = 'administer nodes';
68+
}
69+
$this->contentAuthorUser = $this->drupalCreateUser($permissions);
5670
$this->drupalLogin($this->contentAuthorUser);
57-
}
5871

59-
/**
60-
* Test that quick editor works correctly with images.
61-
*
62-
* @covers ::isCompatible
63-
* @covers ::getAttachments
64-
*/
65-
public function testImageInPlaceEditor() {
6672
// Create a field with a basic filetype restriction.
6773
$field_name = strtolower($this->randomMachineName());
6874
$field_settings = [
@@ -127,13 +133,25 @@ public function testImageInPlaceEditor() {
127133
$this->assertEntityInstanceStates([
128134
'node/1[0]' => 'closed',
129135
]);
136+
137+
$admin_inactive = [];
138+
$admin_candidate = [];
139+
if ($admin_permission) {
140+
$admin_inactive = [
141+
'node/1/uid/en/full' => 'inactive',
142+
'node/1/created/en/full' => 'inactive',
143+
];
144+
$admin_candidate = [
145+
'node/1/uid/en/full' => 'candidate',
146+
'node/1/created/en/full' => 'candidate',
147+
];
148+
}
149+
130150
$this->assertEntityInstanceFieldStates('node', 1, 0, [
131151
'node/1/title/en/full' => 'inactive',
132-
'node/1/uid/en/full' => 'inactive',
133-
'node/1/created/en/full' => 'inactive',
134152
'node/1/body/en/full' => 'inactive',
135153
'node/1/' . $field_name . '/en/full' => 'inactive',
136-
]);
154+
] + $admin_inactive);
137155

138156
// Start in-place editing of the article node.
139157
$this->startQuickEditViaToolbar('node', 1, 0);
@@ -143,33 +161,27 @@ public function testImageInPlaceEditor() {
143161
$this->assertQuickEditEntityToolbar((string) $node->label(), NULL);
144162
$this->assertEntityInstanceFieldStates('node', 1, 0, [
145163
'node/1/title/en/full' => 'candidate',
146-
'node/1/uid/en/full' => 'candidate',
147-
'node/1/created/en/full' => 'candidate',
148164
'node/1/body/en/full' => 'candidate',
149165
'node/1/' . $field_name . '/en/full' => 'candidate',
150-
]);
166+
] + $admin_candidate);
151167

152168
// Click the image field.
153169
$this->click($field_selector);
154170
$this->awaitImageEditor();
155171
$this->assertSession()->elementExists('css', $field_selector . ' .quickedit-image-dropzone');
156172
$this->assertEntityInstanceFieldStates('node', 1, 0, [
157173
'node/1/title/en/full' => 'candidate',
158-
'node/1/uid/en/full' => 'candidate',
159-
'node/1/created/en/full' => 'candidate',
160174
'node/1/body/en/full' => 'candidate',
161175
'node/1/' . $field_name . '/en/full' => 'active',
162-
]);
176+
] + $admin_candidate);
163177

164178
// Type new 'alt' text.
165179
$this->typeInImageEditorAltTextInput('New text');
166180
$this->assertEntityInstanceFieldStates('node', 1, 0, [
167181
'node/1/title/en/full' => 'candidate',
168-
'node/1/uid/en/full' => 'candidate',
169-
'node/1/created/en/full' => 'candidate',
170182
'node/1/body/en/full' => 'candidate',
171183
'node/1/' . $field_name . '/en/full' => 'changed',
172-
]);
184+
] + $admin_candidate);
173185

174186
// Drag and drop an image.
175187
$this->dropImageOnImageEditor($valid_images[1]->uri);
@@ -184,11 +196,9 @@ public function testImageInPlaceEditor() {
184196
]);
185197
$this->assertEntityInstanceFieldStates('node', 1, 0, [
186198
'node/1/title/en/full' => 'candidate',
187-
'node/1/uid/en/full' => 'candidate',
188-
'node/1/created/en/full' => 'candidate',
189199
'node/1/body/en/full' => 'candidate',
190200
'node/1/' . $field_name . '/en/full' => 'saving',
191-
]);
201+
] + $admin_candidate);
192202
$this->assertEntityInstanceFieldMarkup('node', 1, 0, [
193203
'node/1/' . $field_name . '/en/full' => '.quickedit-changed',
194204
]);
@@ -207,4 +217,17 @@ public function testImageInPlaceEditor() {
207217
$this->assertSession()->elementExists('css', $entity_selector . ' ' . $field_selector . ' ' . $new_image_selector);
208218
}
209219

220+
/**
221+
* Data provider for ::testImageInPlaceEditor().
222+
*
223+
* @return array
224+
* Test cases.
225+
*/
226+
public function providerTestImageInPlaceEditor(): array {
227+
return [
228+
'with permission' => [TRUE],
229+
'without permission' => [FALSE],
230+
];
231+
}
232+
210233
}

‎modules/layout_builder/tests/src/FunctionalJavascript/LayoutBuilderQuickEditTest.php

+23-5
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,14 @@ public function testQuickEditIgnoresDuplicateFields() {
113113

114114
$this->drupalLogin($this->contentAuthorUser);
115115
$this->usingLayoutBuilder = TRUE;
116+
$this->assertQuickEditInit(['title']);
117+
$this->drupalLogin($this->drupalCreateUser([
118+
'access contextual links',
119+
'access in-place editing',
120+
'access content',
121+
'edit any article content',
122+
'administer nodes',
123+
]));
116124
$this->assertQuickEditInit(['title', 'uid', 'created']);
117125
}
118126

@@ -124,18 +132,26 @@ public function testQuickEditIgnoresDuplicateFields() {
124132
*
125133
* @dataProvider providerEnableDisableLayoutBuilder
126134
*/
127-
public function testEnableDisableLayoutBuilder($use_revisions) {
135+
public function testEnableDisableLayoutBuilder($use_revisions, $admin_permission = FALSE) {
128136
if (!$use_revisions) {
129137
$content_type = NodeType::load('article');
130138
$content_type->setNewRevision(FALSE);
131139
$content_type->save();
132140
}
133141
$fields = [
134142
'title',
135-
'uid',
136-
'created',
137143
'body',
138144
];
145+
if ($admin_permission) {
146+
$fields = array_merge($fields, ['uid', 'created']);
147+
$this->drupalLogin($this->drupalCreateUser([
148+
'access contextual links',
149+
'access in-place editing',
150+
'access content',
151+
'edit any article content',
152+
'administer nodes',
153+
]));
154+
}
139155

140156
// Test article with Layout Builder disabled.
141157
$this->assertQuickEditInit($fields);
@@ -169,8 +185,10 @@ public function testEnableDisableLayoutBuilder($use_revisions) {
169185
*/
170186
public function providerEnableDisableLayoutBuilder() {
171187
return [
172-
'use revisions' => [TRUE],
173-
'do not use revisions' => [FALSE],
188+
'use revisions, not admin' => [TRUE],
189+
'do not use revisions, not admin' => [FALSE],
190+
'use revisions, admin' => [TRUE, TRUE],
191+
'do not use revisions, admin' => [FALSE, TRUE],
174192
];
175193
}
176194

‎modules/quickedit/src/MetadataGenerator.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public function generateFieldMetadata(FieldItemListInterface $items, $view_mode)
6868

6969
// Early-return if user does not have access.
7070
$access = $this->accessChecker->accessEditEntityField($entity, $field_name);
71-
if (!$access) {
71+
if (!$access->isAllowed()) {
7272
return ['access' => FALSE];
7373
}
7474

‎modules/quickedit/tests/modules/src/MockQuickEditEntityFieldAccessCheck.php

+14-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace Drupal\quickedit_test;
44

5+
use Drupal\Core\Access\AccessResult;
56
use Drupal\Core\Entity\EntityInterface;
67
use Drupal\quickedit\Access\QuickEditEntityFieldAccessCheckInterface;
78

@@ -14,7 +15,19 @@ class MockQuickEditEntityFieldAccessCheck implements QuickEditEntityFieldAccessC
1415
* {@inheritdoc}
1516
*/
1617
public function accessEditEntityField(EntityInterface $entity, $field_name) {
17-
return TRUE;
18+
switch (\Drupal::state()->get('quickedit_test_field_access')) {
19+
case 'allowed':
20+
return AccessResult::allowed();
21+
22+
case 'neutral':
23+
return AccessResult::neutral();
24+
25+
case 'forbidden':
26+
return AccessResult::forbidden();
27+
28+
default:
29+
throw new \OutOfRangeException("The state for the 'quickedit_test_field_access' key must be either 'allowed', 'neutral' or 'forbidden'.");
30+
}
1831
}
1932

2033
}

‎modules/quickedit/tests/src/FunctionalJavascript/QuickEditIntegrationTest.php

-18
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,6 @@ public function testArticleNode() {
146146
]);
147147
$this->assertEntityInstanceFieldStates('node', 1, 0, [
148148
'node/1/title/en/full' => 'inactive',
149-
'node/1/uid/en/full' => 'inactive',
150-
'node/1/created/en/full' => 'inactive',
151149
'node/1/body/en/full' => 'inactive',
152150
'node/1/field_tags/en/full' => 'inactive',
153151
]);
@@ -160,8 +158,6 @@ public function testArticleNode() {
160158
$this->assertQuickEditEntityToolbar((string) $node->label(), NULL);
161159
$this->assertEntityInstanceFieldStates('node', 1, 0, [
162160
'node/1/title/en/full' => 'candidate',
163-
'node/1/uid/en/full' => 'candidate',
164-
'node/1/created/en/full' => 'candidate',
165161
'node/1/body/en/full' => 'candidate',
166162
'node/1/field_tags/en/full' => 'candidate',
167163
]);
@@ -174,8 +170,6 @@ public function testArticleNode() {
174170
$this->assertQuickEditEntityToolbar((string) $node->label(), 'Title');
175171
$this->assertEntityInstanceFieldStates('node', 1, 0, [
176172
'node/1/title/en/full' => 'active',
177-
'node/1/uid/en/full' => 'candidate',
178-
'node/1/created/en/full' => 'candidate',
179173
'node/1/body/en/full' => 'candidate',
180174
'node/1/field_tags/en/full' => 'candidate',
181175
]);
@@ -188,8 +182,6 @@ public function testArticleNode() {
188182
$this->awaitEntityInstanceFieldState('node', 1, 0, 'title', 'en', 'changed');
189183
$this->assertEntityInstanceFieldStates('node', 1, 0, [
190184
'node/1/title/en/full' => 'changed',
191-
'node/1/uid/en/full' => 'candidate',
192-
'node/1/created/en/full' => 'candidate',
193185
'node/1/body/en/full' => 'candidate',
194186
'node/1/field_tags/en/full' => 'candidate',
195187
]);
@@ -201,8 +193,6 @@ public function testArticleNode() {
201193
$this->assertQuickEditEntityToolbar((string) $node->label(), 'Body');
202194
$this->assertEntityInstanceFieldStates('node', 1, 0, [
203195
'node/1/title/en/full' => 'saving',
204-
'node/1/uid/en/full' => 'candidate',
205-
'node/1/created/en/full' => 'candidate',
206196
'node/1/body/en/full' => 'active',
207197
'node/1/field_tags/en/full' => 'candidate',
208198
]);
@@ -225,8 +215,6 @@ public function testArticleNode() {
225215
$assert_session->waitForElement('css', '.quickedit-toolbar-field div[id*="tags"]');
226216
$this->assertQuickEditEntityToolbar((string) $node->label(), 'Tags');
227217
$this->assertEntityInstanceFieldStates('node', 1, 0, [
228-
'node/1/uid/en/full' => 'candidate',
229-
'node/1/created/en/full' => 'candidate',
230218
'node/1/body/en/full' => 'candidate',
231219
'node/1/field_tags/en/full' => 'activating',
232220
'node/1/title/en/full' => 'candidate',
@@ -241,8 +229,6 @@ public function testArticleNode() {
241229
// Wait for the form to load.
242230
$this->assertJsCondition('document.querySelector(\'.quickedit-form-container > .quickedit-form[role="dialog"] > .placeholder\') === null');
243231
$this->assertEntityInstanceFieldStates('node', 1, 0, [
244-
'node/1/uid/en/full' => 'candidate',
245-
'node/1/created/en/full' => 'candidate',
246232
'node/1/body/en/full' => 'candidate',
247233
'node/1/field_tags/en/full' => 'active',
248234
'node/1/title/en/full' => 'candidate',
@@ -252,8 +238,6 @@ public function testArticleNode() {
252238
$this->typeInFormEditorTextInputField('field_tags[target_id]', 'foo, bar');
253239
$this->awaitEntityInstanceFieldState('node', 1, 0, 'field_tags', 'en', 'changed');
254240
$this->assertEntityInstanceFieldStates('node', 1, 0, [
255-
'node/1/uid/en/full' => 'candidate',
256-
'node/1/created/en/full' => 'candidate',
257241
'node/1/body/en/full' => 'candidate',
258242
'node/1/field_tags/en/full' => 'changed',
259243
'node/1/title/en/full' => 'candidate',
@@ -266,8 +250,6 @@ public function testArticleNode() {
266250
'node/1[0]' => 'committing',
267251
]);
268252
$this->assertEntityInstanceFieldStates('node', 1, 0, [
269-
'node/1/uid/en/full' => 'candidate',
270-
'node/1/created/en/full' => 'candidate',
271253
'node/1/body/en/full' => 'candidate',
272254
'node/1/field_tags/en/full' => 'saving',
273255
'node/1/title/en/full' => 'candidate',

‎modules/quickedit/tests/src/Kernel/MetadataGeneratorTest.php

+15
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,11 @@ public function testSimpleEntityType() {
9797

9898
// Verify metadata for field 1.
9999
$items_1 = $entity->get($field_1_name);
100+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
101+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_1, 'default'));
102+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
103+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_1, 'default'));
104+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
100105
$metadata_1 = $this->metadataGenerator->generateFieldMetadata($items_1, 'default');
101106
$expected_1 = [
102107
'access' => TRUE,
@@ -107,6 +112,11 @@ public function testSimpleEntityType() {
107112

108113
// Verify metadata for field 2.
109114
$items_2 = $entity->get($field_2_name);
115+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
116+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_2, 'default'));
117+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
118+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items_2, 'default'));
119+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
110120
$metadata_2 = $this->metadataGenerator->generateFieldMetadata($items_2, 'default');
111121
$expected_2 = [
112122
'access' => TRUE,
@@ -163,6 +173,11 @@ public function testEditorWithCustomMetadata() {
163173

164174
// Verify metadata.
165175
$items = $entity->get($field_name);
176+
\Drupal::state()->set('quickedit_test_field_access', 'forbidden');
177+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
178+
\Drupal::state()->set('quickedit_test_field_access', 'neutral');
179+
$this->assertSame(['access' => FALSE], $this->metadataGenerator->generateFieldMetadata($items, 'default'));
180+
\Drupal::state()->set('quickedit_test_field_access', 'allowed');
166181
$metadata = $this->metadataGenerator->generateFieldMetadata($items, 'default');
167182
$expected = [
168183
'access' => TRUE,

0 commit comments

Comments
 (0)