Undefined variable $user (RestrictionService.php line 658)

[charlyecho]

Hi James,
we have an issue on our project.

we call a custom mutation from a module with no authentication token (because it is a public mutation allowed to anyone).

In the code, restrictionService from line 654 to line 666, the code assume $user is defined, but the $user is defined only if tokenService->getHeaderToken() condition is true.

Can you fix this ?

I suggest moving line 654 to line 666 inside the getHeaderToken condition or checking $user is defined.

Regards

[jamesedmonston]

@charlyecho can you show me what your custom mutation is doing?

[charlyecho]

Hi James,
here we go :

$event->mutations['reportStory'] = [
            'description' => 'Report a story',
            'type' => Type::nonNull(Type::string()),
            'args' => [
                'elementId' => Type::nonNull(Type::int()),
            ],
            'resolve' => function ($source, array $arguments) use ($elementsService) {
                $element = $elementsService->getElementById((int) $arguments['elementId']);
                if (!$element) {
                    throw new Exception("Element not found");
                }

                $nb = (int) $element->getFieldValue("reportCounter");
                $element->setFieldValue("reportCounter", $nb+1);
                //  Craft::$app->request->setIsCpRequest(true); (hack for not having the issue)
                if ($elementsService->saveElement($element)) {
                    return "Story reported";

                }
                return "Story not reported";
            },
        ];

[robinbeatty]

Hey, I'm having a similar issue:

I'm calling a regular save_[section]_[entryType]_Entry mutation which should post some asset ids into an assets field. Many of the assets in the system don't have an uploader id as they were indexed from a remote source (AWS). The mutation will add these assets to the field fine, but if there is an uploader id set on the asset (they were uploaded via the craft cp) The mutation fails because of the same 'Undefined variable $user' as above (RestrictionService.php:658). Having tinkered with permissions/validation settings (Craft, Your plugin, The asset field) for some days I still can't find a solution so assuming it's a bug. Could you take a look?

[jamesedmonston]

@robinbeatty thanks for your PR! I've added your fix to the private entry checks, too. Will release this in an update shortly.

[jamesedmonston]

Released in 2.5.0!