Skip to content

should specify accessCheck(FALSE) in entity queries?

Problem/Motivation

I have a site where the anonymous user cannot view published content. You MUST be authenticated in order to proceed. When trying to generate content with devel_generate during testing using the --kill parameter, no content is deleted (though content is generated). Similarly, when trying to use drush entity:delete to remove the content before generating some, the message "No matching entities found." is displayed, despite there being many entities available to be deleted.

Proposed resolution

References:

in core/lib/Drupal/Core/Entity/Query/Sql, the following code exists:

    if (is_null($this->accessCheck)) {
      $this->accessCheck = TRUE;
      @trigger_error('Relying on entity queries to check access by default is deprecated in drupal:9.2.0 and an error will be thrown from drupal:10.0.0. Call \Drupal\Core\Entity\Query\QueryInterface::accessCheck() with TRUE or FALSE to specify whether access should be checked. See https://www.drupal.org/node/3201242', E_USER_DEPRECATED);
    }

According to that change record, and the corresponding issue, accessCheck should be explicitly passed in these queries.

I propose adding accessCheck(FALSE) to these use cases, ex.g.

EntityCommands.php, line 72: $result = $query->accessCheck(FALSE)->execute();

ContentDevelGenerate.php, line 578:

  $nids = $this->nodeStorage->getQuery()
      ->condition('type', array_values($values['node_types']), 'IN')
      ->accessCheck(FALSE)
      ->execute();

...is that the right solution?

Edited by Chris Wells