Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 300692

Properties of FieldType 'comment' should be declared computed

$
0
0

The comment FieldType defines several properties :

  • status
  • cid
  • last_comment_timestamp
  • last_comment_name
  • last_comment_uid
  • comment_count

Aside from status, all other properties are not meant to be updated from outside Drupal (e.g. through JSON:API or GraphQL), thus they all should be declared as computed property :

    $properties['last_comment_timestamp'] = DataDefinition::create('integer')
      ->setLabel(t('Last comment timestamp'))
      ->setDescription(t('The time that the last comment was created.'))
      ->setComputed(TRUE);

A little bit of background:

When using JSON:API to retrieve, alter (e.g. changing the title) and save back a node that has a field of type comment field, if the application does not take care of "removing" that field before issuing the PATCH request, there's a risk that the update operation is denied because comments have been added/updated on this particular node.

This is because as those properties are not declared as computed, JSON:API checks that user have write access to these, if they were updated. If they don't match because comments were added/updated, it is considered an update and the whole node update request is denied.


Viewing all articles
Browse latest Browse all 300692

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>