This is a bug, of course, because node access query filters should be applied by node module.

The check in node_access_view_all_nodes() is not respected by $query->executeFirstPass(), which always performs the node access JOIN, which means you can no longer disable node access on search queries (which is a feature I've been using since Drupal 5).

For proof, run an access-limited search. Then watch the query passed in to node_query_node_access_alter, which will already be JOINed to {node_access}.

This may be due to the fact that search.extender.inc is doing something odd, but I haven't figured that part out yet.

CommentFileSizeAuthor
#2 1382292-search-node-access.patch823 bytesagentrickard

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

I don't see where executeFirstPass() involves node access. Only thing I can see is that the query is cloned to run the first pass, and has the node access tag from node_search_execute().

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Active » Needs review
StatusFileSize
new 1382292-search-node-access.patch823 bytes

That's what happens. The clone doesn't prevent the execute() from altering the base query object.

Here's a patch that sidesteps the issue, but is probably Doing It Wrong.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Priority: Normal » Minor

This may be entirely self-inflicted. Testing.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Needs review » Closed (works as designed)

Ignore me. I did something stupid in my module.