Drupal Association members fund grants that make connections all over the world.
In Drupal Core 6.x, the query that built the admin/content/node page was passed through the node access system, and any node access module that implemented hook_db_rewrite_sql() could remove the API nodes from the page.
In 7.x, the query for that page isn't run through the node access system (there is no "node_access" tag added to the query). Instead, anyone with "view content overview" permission gets to see all published nodes.
This needs tests which need to be backported to D7. There's a node_test.module that implements some node access stuff afaik.
Commit credit should go to jhodgdon. Here's the patch we committed to D7.
Private tracker #: 72648
PASSED: [[SimpleTest]]: [MySQL] 39,352 pass(es). View
FAILED: [[SimpleTest]]: [MySQL] 39,810 pass(es), 1 fail(s), and 0 exception(s). View
PASSED: [[SimpleTest]]: [MySQL] 40,131 pass(es). View
PASSED: [[SimpleTest]]: [MySQL] 37,292 pass(es). View