Due to the access call in template_process_flag, node_load gets called even if access was already checked via flag_access_multiple.

There's two parts
1) in the flag access function itself, the check for content is applicable is called (which has already been tested for this content as far as I can guess)
2) in flag_flag_access, the check for author (which has already been checked also).

Patch re-arranges things to avoid those two calls, but it feels like problem is with using the same access hooks/function for both flag and unflag, when flag has already been checked, and would be better to separate.

CommentFileSizeAuthor
#3 flag_do_not_call_applies_to_content_id_for_unflag-3.patch2.79 KBgoron
#2 flag_do_not_call_applies_to_content_id_for_unflag-2.patch3.04 KBgoron
flag_do_not_call_applies_to_content_id_for_unflag.patch2.42 KBhefox
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

hefox’s picture

hefox CreditAttribution: hefox commented
Version: 6.x-1.x-dev » 6.x-2.x-dev
Status: Active » Needs review
goron’s picture

goron CreditAttribution: goron commented
FileSize
flag_do_not_call_applies_to_content_id_for_unflag-2.patch3.04 KB

Getting error:

Declaration of flag_user::access() should be compatible with that of flag_flag::access() in include_once() (line 13 of .../flag.module).

Extended the addition above to flag_user::access()

goron’s picture

goron CreditAttribution: goron commented
FileSize
flag_do_not_call_applies_to_content_id_for_unflag-3.patch2.79 KB

Well, not actually sure if the skip_content_check, should apply for flag_user. So here it doesn't.

joachim’s picture

joachim CreditAttribution: joachim commented
Version: 6.x-2.x-dev » 7.x-2.x-dev
Status: Needs review » Needs work

Needs to be applied to the 7-2 branch first.

joachim’s picture

joachim CreditAttribution: joachim commented
Version: 7.x-2.x-dev » 7.x-3.x-dev
joachim’s picture

joachim CreditAttribution: joachim commented 
+++ b/flag.inc
@@ -413,13 +413,16 @@ class flag_flag {
+  function access($content_id, $action = NULL, $account = NULL, $skip_content_check = FALSE) {

This extra parameter is the subject of another issue elsewhere, isn't it?