diff --git a/modules/comment/comment.module b/modules/comment/comment.module index 429c3b0..bc240d0 100644 --- a/modules/comment/comment.module +++ b/modules/comment/comment.module @@ -507,6 +507,7 @@ function comment_get_recent($number = 10) { $query = db_select('comment', 'c'); $query->innerJoin('node', 'n', 'n.nid = c.nid'); $query->addTag('node_access'); + $query->addMetaData('base_table', 'comment'); $comments = $query ->fields('c') ->condition('c.status', COMMENT_PUBLISHED) @@ -826,6 +827,7 @@ function comment_get_thread($node, $mode, $comments_per_page) { ->condition('c.nid', $node->nid) ->addTag('node_access') ->addTag('comment_filter') + ->addMetaData('base_table', 'comment') ->addMetaData('node', $node) ->limit($comments_per_page); @@ -835,6 +837,7 @@ function comment_get_thread($node, $mode, $comments_per_page) { ->condition('c.nid', $node->nid) ->addTag('node_access') ->addTag('comment_filter') + ->addMetaData('base_table', 'comment') ->addMetaData('node', $node); if (!user_access('administer comments')) { diff --git a/modules/forum/forum.module b/modules/forum/forum.module index 7e8d81b..d5dbac9 100644 --- a/modules/forum/forum.module +++ b/modules/forum/forum.module @@ -676,7 +676,8 @@ function forum_block_save($delta = '', $edit = array()) { function forum_block_view($delta = '') { $query = db_select('forum_index', 'f') ->fields('f') - ->addTag('node_access'); + ->addTag('node_access') + ->addMetaData('base_table', 'forum_index'); switch ($delta) { case 'active': $title = t('Active forum topics'); @@ -924,6 +925,7 @@ function forum_get_topics($tid, $sortby, $forum_per_page) { $query ->condition('f.tid', $tid) ->addTag('node_access') + ->addMetaData('base_table', 'forum_index') ->orderBy('f.sticky', 'DESC') ->orderByHeader($forum_topic_list_header) ->limit($forum_per_page); @@ -932,6 +934,7 @@ function forum_get_topics($tid, $sortby, $forum_per_page) { $count_query->condition('f.tid', $tid); $count_query->addExpression('COUNT(*)'); $count_query->addTag('node_access'); + $count_query->addMetaData('base_table', 'forum_index'); $query->setCountQuery($count_query); $result = $query->execute(); diff --git a/modules/forum/forum.test b/modules/forum/forum.test index d78d962..5f57f7d 100644 --- a/modules/forum/forum.test +++ b/modules/forum/forum.test @@ -676,3 +676,94 @@ class ForumIndexTestCase extends DrupalWebTestCase { $this->assertNoText($title, 'Unpublished forum topic no longer appears on index.'); } } + + +/** + * Tests forum block view for private node access. + */ +class ForumNodeAccessTestCase extends WebTestBase { + protected $access_user; + protected $admin_user; + protected $no_access_user; + + public static function getInfo() { + return array( + 'name' => 'Forum private node access test', + 'description' => 'Tests forum block view for private node access', + 'group' => 'Forum', + ); + } + + function setUp() { + parent::setUp(array('node', 'comment', 'forum', 'taxonomy', 'tracker', 'node_access_test', 'block')); + node_access_rebuild(); + variable_set('node_access_test_private', TRUE); + } + + /** + * Creates some users and creates a public node and a private node. + * + * Adds both active forum topics and new forum topics blocks to the sidebar. + * Tests to ensure private node/public node access is respected on blocks. + */ + function testForumNodeAccess() { + // Create some users. + $access_user = $this->drupalCreateUser(array('node test view')); + $no_access_user = $this->drupalCreateUser(); + $admin_user = $this->drupalCreateUser(array('access administration pages', 'administer modules', 'administer blocks', 'create forum content')); + + $this->drupalLogin($admin_user); + + // Create a private node. + $langcode = LANGUAGE_NOT_SPECIFIED; + $private_node_title = $this->randomName(20); + $edit = array( + 'title' => $private_node_title, + "body[$langcode][0][value]" => $this->randomName(200), + 'private' => TRUE, + ); + $this->drupalPost('node/add/forum/1', $edit, t('Save')); + $private_node = $this->drupalGetNodeByTitle($private_node_title); + $this->assertTrue(!empty($private_node), 'New private forum node found in database.'); + + // Create a public node. + $public_node_title = $this->randomName(20); + $edit = array( + 'title' => $public_node_title, + "body[$langcode][0][value]" => $this->randomName(200), + ); + $this->drupalPost('node/add/forum/1', $edit, t('Save')); + $public_node = $this->drupalGetNodeByTitle($public_node_title); + $this->assertTrue(!empty($public_node), 'New public forum node found in database.'); + + // Enable the active forum block. + $edit = array(); + $edit['blocks[forum_active][region]'] = 'sidebar_second'; + $this->drupalPost('admin/structure/block', $edit, t('Save blocks')); + $this->assertResponse(200); + $this->assertText(t('The block settings have been updated.'), 'Active forum topics forum block was enabled'); + + // Enable the new forum block. + $edit = array(); + $edit['blocks[forum_new][region]'] = 'sidebar_second'; + $this->drupalPost('admin/structure/block', $edit, t('Save blocks')); + $this->assertResponse(200); + $this->assertText(t('The block settings have been updated.'), '[New forum topics] Forum block was enabled'); + + // Test for $access_user. + $this->drupalLogin($access_user); + $this->drupalGet('/'); + + // Ensure private node and public node are found. + $this->assertText($private_node->title, 'Private node found in block by $access_user'); + $this->assertText($public_node->title, 'Public node found in block by $access_user'); + + // Test for $no_access_user. + $this->drupalLogin($no_access_user); + $this->drupalGet('/'); + + // Ensure private node is not found but public is found. + $this->assertNoText($private_node->title, 'Private node not found in block by $no_access_user'); + $this->assertText($public_node->title, 'Public node found in block by $no_access_user'); + } +} \ No newline at end of file diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module index d501282..4f084d2 100644 --- a/modules/taxonomy/taxonomy.module +++ b/modules/taxonomy/taxonomy.module @@ -207,6 +207,7 @@ function taxonomy_select_nodes($tid, $pager = TRUE, $limit = FALSE, $order = arr } $query = db_select('taxonomy_index', 't'); $query->addTag('node_access'); + $query->addMetaData('base_table', 'taxonomy_index'); $query->condition('tid', $tid); if ($pager) { $count_query = clone $query; diff --git a/modules/tracker/tracker.pages.inc b/modules/tracker/tracker.pages.inc index baa9986..a52aff1 100644 --- a/modules/tracker/tracker.pages.inc +++ b/modules/tracker/tracker.pages.inc @@ -32,6 +32,7 @@ function tracker_page($account = NULL, $set_title = FALSE) { // while keeping the correct order. $nodes = $query ->addTag('node_access') + ->addMetaData('base_table', 'tracker_node') ->fields('t', array('nid', 'changed')) ->condition('t.published', 1) ->orderBy('t.changed', 'DESC') diff --git a/modules/tracker/tracker.test b/modules/tracker/tracker.test index d429210..ae5e51c 100644 --- a/modules/tracker/tracker.test +++ b/modules/tracker/tracker.test @@ -266,3 +266,60 @@ class TrackerTest extends DrupalWebTestCase { $this->assertText(t('No content available.'), t('Node is displayed on the tracker listing pages.')); } } + +/** + * Tests for private node access on /tracker. + */ +class TrackerNodeAccessTestCase extends WebTestBase { + protected $access_user; + protected $no_access_user; + + public static function getInfo() { + return array( + 'name' => 'Tracker Node Access Tests', + 'description' => 'Tests for private node access on /tracker.', + 'group' => 'Tracker', + ); + } + + public function setUp() { + parent::setUp(array('node', 'comment', 'tracker', 'node_access_test')); + node_access_rebuild(); + variable_set('node_access_test_private', TRUE); + } + + + /** + * Ensure private node on /tracker is only visible to users with permission. + */ + function testTrackerNodeAccess() { + // Create user with node test view permission. + $access_user = $this->drupalCreateUser(array('node test view')); + + // Create user without node test view permission. + $no_access_user = $this->drupalCreateuser(); + + $this->drupalLogin($access_user); + + // Create some nodes. + $private_node = $this->drupalCreateNode(array( + 'title' => t('Private node test'), + 'private'=> TRUE, + )); + $public_node = $this->drupalCreateNode(array( + 'title' => t('Public node test'), + 'private'=>FALSE, + )); + + // User with access should see both nodes created. + $this->drupalGet('tracker'); + $this->assertText($private_node->title, 'Private node is visible to user with private access.'); + $this->assertText($public_node->title, 'Public node is visible to user with private access.'); + + // User without access should not see private node. + $this->drupalLogin($no_access_user); + $this->drupalGet('tracker'); + $this->assertNoText($private_node->title, 'Private node is not visible to user without private access.'); + $this->assertText($public_node->title, 'Public node is visible to user without private access.'); + } +}