From 27a799e937f59e4b59b6aa523becb0f6cbb7e290 Mon Sep 17 00:00:00 2001
From: bach <bachir@figureslibres.io>
Date: Fri, 4 Sep 2026 12:22:26 +0200
Subject: [PATCH] Lock down the generic entity autocomplete route to logged-in
 users

Found while adding field_entree_liee's autocomplete: core's
system.entity_autocomplete route is '_access: TRUE' by design --
EntityQuery::accessCheck() only enforces node grants (published
status), not the base 'access content' permission, so it doesn't
respect this site's login-only lockdown the way every other route
does. Verified anonymously via plain curl that the *existing*
field_client (client taxonomy) autocomplete leaked real client names
the same way -- this isn't specific to the new field, it's a gap in
any entity reference autocomplete on the site.

hook_route_alter() doesn't exist anymore in this Drupal version
(routing moved to an event-based RoutingEvents::ALTER subscriber) --
a first attempt using the procedural hook silently did nothing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../figli_compta_ledger.services.yml          |  5 +++
 .../src/EventSubscriber/RouteSubscriber.php   | 31 +++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml
 create mode 100644 web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php

diff --git a/web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml b/web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml
new file mode 100644
index 0000000..369d4ce
--- /dev/null
+++ b/web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml
@@ -0,0 +1,5 @@
+services:
+  figli_compta_ledger.route_subscriber:
+    class: Drupal\figli_compta_ledger\EventSubscriber\RouteSubscriber
+    tags:
+      - { name: event_subscriber }
diff --git a/web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php b/web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php
new file mode 100644
index 0000000..c4eea19
--- /dev/null
+++ b/web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Drupal\figli_compta_ledger\EventSubscriber;
+
+use Drupal\Core\Routing\RouteSubscriberBase;
+use Symfony\Component\Routing\RouteCollection;
+
+/**
+ * Core's generic entity autocomplete route ('system.entity_autocomplete')
+ * is '_access: TRUE' by design -- EntityQuery::accessCheck() only enforces
+ * node grants (published status), not the base 'access content'
+ * permission, so it doesn't actually block anonymous users the way every
+ * other route on this confidential site does. Discovered while adding
+ * field_entree_liee's autocomplete: verified the *existing* field_client
+ * (client taxonomy) autocomplete had the same gap, leaking real client
+ * names to anonymous requests via a plain curl call. Since every field on
+ * this content type is confidential, lock the route down site-wide rather
+ * than special-casing our own field.
+ */
+class RouteSubscriber extends RouteSubscriberBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function alterRoutes(RouteCollection $collection) {
+    if ($route = $collection->get('system.entity_autocomplete')) {
+      $route->setRequirement('_permission', 'access content');
+    }
+  }
+
+}