node_query_node_access_alter(AlterableInterface $query)
Implements hook_query_TAG_alter().
This is the hook_query_alter() for queries tagged with 'node_access'. It adds node access checks for the user account given by the 'account' meta-data (or current user if not provided), for an operation given by the 'op' meta-data (or 'view' if not provided; other possible values are 'update' and 'delete').
Queries tagged with 'node_access' that are not against the {node} table must add the base table as metadata. For example:
1 2 3 | $query ->addTag('node_access') ->addMetaData('base_table', 'taxonomy_index'); |
Related topics
- Node access rights
- The node access system determines who can do what to which nodes.
File
- core/modules/node/node.module, line 1023
- The core module that allows content to be submitted to the site.
Code
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 | function node_query_node_access_alter(AlterableInterface $query) { // Read meta-data from query, if provided. if (!$account = $query->getMetaData('account')) { $account = \Drupal::currentUser(); } if (!$op = $query->getMetaData('op')) { $op = 'view'; } // If $account can bypass node access, or there are no node access modules, // or the operation is 'view' and the $account has a global view grant // (such as a view grant for node ID 0), we don't need to alter the query. if ($account->hasPermission('bypass node access')) { return; } if (!count(\Drupal::moduleHandler()->getImplementations('node_grants'))) { return; } if ($op == 'view' && node_access_view_all_nodes($account)) { return; } $tables = $query->getTables(); $base_table = $query->getMetaData('base_table'); // If the base table is not given, default to one of the node base tables. if (!$base_table) { /** @var \Drupal\Core\Entity\Sql\DefaultTableMapping $table_mapping */ $table_mapping = \Drupal::entityTypeManager()->getStorage('node')->getTableMapping(); $node_base_tables = $table_mapping->getTableNames(); foreach ($tables as $table_info) { if (!($table_info instanceof SelectInterface)) { $table = $table_info['table']; // Ensure that 'node' and 'node_field_data' are always preferred over // 'node_revision' and 'node_field_revision'. if ($table == 'node' || $table == 'node_field_data') { $base_table = $table; break; } // If one of the node base tables are in the query, add it to the list // of possible base tables to join against. if (in_array($table, $node_base_tables)) { $base_table = $table; } } } // Bail out if the base table is missing. if (!$base_table) { throw new Exception(t('Query tagged for node access but there is no node table, specify the base_table using meta data.')); } } // Update the query for the given storage method. \Drupal::service('node.grant_storage')->alterQuery($query, $tables, $op, $account, $base_table); // Bubble the 'user.node_grants:$op' cache context to the current render // context. $request = \Drupal::requestStack()->getCurrentRequest(); $renderer = \Drupal::service('renderer'); if ($request->isMethodSafe() && $renderer->hasRenderContext()) { $build = ['#cache' => ['contexts' => ['user.node_grants:' . $op]]]; $renderer->render($build); }} |
Please login to continue.