function CommentSelection::entityQueryAlter

Overrides SelectionPluginBase::entityQueryAlter

File

core/modules/comment/src/Plugin/EntityReferenceSelection/CommentSelection.php, line 91

Class

CommentSelection

Provides specific access control for the comment entity type.

Namespace

Code

public function entityQueryAlter(SelectInterface $query) {
  parent::entityQueryAlter($query);
  $tables = $query->getTables();
  $data_table = 'comment_field_data';
  if (!isset($tables['comment_field_data']['alias'])) {
    // If no conditions join against the comment data table, it should be
    // joined manually to allow node access processing.
    $query->innerJoin($data_table, NULL, "[base_table].[cid] = [{$data_table}].[cid] AND [{$data_table}].[default_langcode] = 1");
  }
  // Historically, comments were always linked to 'node' entities, but that is
  // no longer the case, as the 'node' module might not even be enabled.
  // Comments can now be linked to any entity and they can also be referenced
  // by other entities, so we won't have a single table to join to. That
  // actually means that we can no longer optimize the query on those cases.
  // However, the most common case remains to be comment replies, and in this
  // case, we can get the host entity type if the 'entity' value is present
  // and perform the extra joins and alterations needed.
  $comment = $this->getConfiguration()['entity'];
  if ($comment instanceof CommentInterface) {
    $host_entity_type_id = $comment->getCommentedEntityTypeId();
    /** @var \Drupal\Core\Entity\EntityTypeInterface $host_entity_type */
    $host_entity_type = $this->entityTypeManager
      ->getDefinition($host_entity_type_id);
    $host_entity_field_data_table = $host_entity_type->getDataTable();
    // Not all entities have a data table, so check first.
    if ($host_entity_field_data_table) {
      $id_key = $host_entity_type->getKey('id');
      // The Comment module doesn't implement per-comment access, so it
      // checks instead that the user has access to the host entity.
      $entity_alias = $query->innerJoin($host_entity_field_data_table, 'n', "[%alias].[{$id_key}] = [{$data_table}].[entity_id] AND [{$data_table}].[entity_type] = '{$host_entity_type_id}'");
      // Pass the query to the entity access control.
      $this->reAlterQuery($query, $host_entity_type_id . '_access', $entity_alias);
      // Additional checks for "node" entities.
      if ($host_entity_type_id === 'node') {
        // Passing the query to node_query_node_access_alter() is sadly
        // insufficient for nodes.
        // @see \Drupal\node\Plugin\EntityReferenceSelection\NodeSelection::buildEntityQuery()
        if (!$this->currentUser
          ->hasPermission('bypass node access') && !$this->moduleHandler
          ->hasImplementations('node_grants')) {
          $query->condition($entity_alias . '.status', 1);
        }
      }
    }
  }
}