function CommentSelection::entityQueryAlter

Overrides SelectionPluginBase::entityQueryAlter

File

core/modules/comment/src/Plugin/EntityReferenceSelection/CommentSelection.php, line 91

Class

CommentSelection

Provides specific access control for the comment entity type.

Namespace

Code

public function entityQueryAlter(SelectInterface $query) {
    parent::entityQueryAlter($query);
    $tables = $query->getTables();
    $data_table = 'comment_field_data';
    if (!isset($tables['comment_field_data']['alias'])) {
        // If no conditions join against the comment data table, it should be
        // joined manually to allow node access processing.
        $query->innerJoin($data_table, NULL, "[base_table].[cid] = [{$data_table}].[cid] AND [{$data_table}].[default_langcode] = 1");
    }
    // Historically, comments were always linked to 'node' entities, but that is
    // no longer the case, as the 'node' module might not even be enabled.
    // Comments can now be linked to any entity and they can also be referenced
    // by other entities, so we won't have a single table to join to. That
    // actually means that we can no longer optimize the query on those cases.
    // However, the most common case remains to be comment replies, and in this
    // case, we can get the host entity type if the 'entity' value is present
    // and perform the extra joins and alterations needed.
    $comment = $this->getConfiguration()['entity'];
    if ($comment instanceof CommentInterface) {
        $host_entity_type_id = $comment->getCommentedEntityTypeId();
        
        /** @var \Drupal\Core\Entity\EntityTypeInterface $host_entity_type */
        $host_entity_type = $this->entityTypeManager
            ->getDefinition($host_entity_type_id);
        $host_entity_field_data_table = $host_entity_type->getDataTable();
        // Not all entities have a data table, so check first.
        if ($host_entity_field_data_table) {
            $id_key = $host_entity_type->getKey('id');
            // The Comment module doesn't implement per-comment access, so it
            // checks instead that the user has access to the host entity.
            $entity_alias = $query->innerJoin($host_entity_field_data_table, 'n', "[%alias].[{$id_key}] = [{$data_table}].[entity_id] AND [{$data_table}].[entity_type] = '{$host_entity_type_id}'");
            // Pass the query to the entity access control.
            $this->reAlterQuery($query, $host_entity_type_id . '_access', $entity_alias);
            // Additional checks for "node" entities.
            if ($host_entity_type_id === 'node') {
                // Passing the query to node_query_node_access_alter() is sadly
                // insufficient for nodes.
                // @see \Drupal\node\Plugin\EntityReferenceSelection\NodeSelection::buildEntityQuery()
                if (!$this->currentUser
                    ->hasPermission('bypass node access') && !$this->moduleHandler
                    ->hasImplementations('node_grants')) {
                    $query->condition($entity_alias . '.status', 1);
                }
            }
        }
    }
}