Review node access controlls [#10977]

We had discussed in #drupal that we need to review the success of our node access controlls before releasing Drupal 4.5.

For starters I found that our feed function do not honour our acccess lists at all. See attached patch.

This:
grep "{node}" * | grep -v node_access_join_sql

Might be usefull in spotting other weaknesses. Not all of those queries need fixing, of course.

Comment	File	Size	Author
#12	book_13.patch	959 bytes	killes@www.drop.org
#12
#7	book_12.patch	6.35 KB	killes@www.drop.org
#7
#6	comment_7.patch	1.36 KB	killes@www.drop.org
#6
#4	blog_5.patch	1000 bytes	killes@www.drop.org
#4
	feed.patch	3.3 KB	killes@www.drop.org

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Dries CreditAttribution: Dries commented 21 September 2004 at 18:44

The atom module probably needs to be udpated too.

IMO, it wouldn't hurt to have _db_query() check whether the access controls are in place.

Comment #2

(not verified) CreditAttribution: commented 21 September 2004 at 19:10

Uh oh!

This patch also seemed to include the changes decided to be a bad idea over in this issue... namely, it sorts the "latest blog entries" by sticky, forcing all users' sticky posts to the top and obscuring the actual newest posts.

I'm not near a workstation where I can make a patch at the moment, but the change that needs to be made is:
"BY n.sticky DESC, " should be removed from line 163 of blog.module. (in the function blog_page_last()).

Setting this back to patch so it gets attention.

Comment #3

killes@www.drop.org CreditAttribution: killes@www.drop.org commented 21 September 2004 at 19:31

Yeah, sorry, unclean patch base. Patch forthcoming.

Comment #4

killes@www.drop.org CreditAttribution: killes@www.drop.org commented 21 September 2004 at 19:35

File	Size
blog_5.patch	1000 bytes

This patch reverts the ORDER BY change. Sorry again.

Comment #5

Dries CreditAttribution: Dries commented 21 September 2004 at 21:30

Comment #6

killes@www.drop.org CreditAttribution: killes@www.drop.org commented 23 September 2004 at 21:26

Assigned:

Unassigned

» killes@www.drop.org

File	Size
comment_7.patch	1.36 KB

Here is another patch. The comment search would have shown matching comments even if you could not access them because the node isn't accessible. The patch isn't really tested for lack of test data.