unpublished nodes accessable by anonymous users - Module activation publishes (all?) [#2124911]

Activating the base module (Taxonomy Tools module, none of the other ones included were needed to reproduce) and rebuilding the permissions causes all unpublished nodes (incl. basic pages etc) to be visible to anonymous users.

Deactivating the module immediately reverses this behavior.

Reproduce:

- Drupal 7.23
- To be sure about conflicts I deactivated nearly all other non-core modules (and all unnecessary core modules). Currently activated other modules: Chaos Tools, Entity Reference, Entity API
- All anonymous permissions unchanged. Only access to published content.
- Create a basic page, mark it as unpublished
- View the node as anonymous. Should be "Access denied"
- Activate the Taxonomy Tools Module and rebuild permissions, clear the cache
- Reload page as anonymous -> visible (here, at least)
- Disable the suspicious module
- Reload -> "Access denied"

Comments

Comment #1

wickwood CreditAttribution: wickwood commented 3 December 2013 at 04:37

I just discovered this too! Super Critical Bug!!!

Too bad looked like it could have been useful.

Comment #2

inventlogic CreditAttribution: inventlogic commented 6 January 2014 at 19:52

Title:	Module activation publishes (all?) unpublished nodes	» unpublished nodes accessable by anonymous users - Module activation publishes (all?)
Issue summary:	View changes

Wasted two days tracking this down.

As above just enabling the Taxonomy Tools module gives anonymous users access to4npublished content.

This should be a priority for the developers.

Comment #3

balintcsaba CreditAttribution: balintcsaba commented 7 January 2014 at 07:18

Assigned:

Unassigned

» martins.bertins

Comment #4

martins.bertins CreditAttribution: martins.bertins commented 14 March 2014 at 11:48

Status:

Active

» Fixed

Fix committed

Comment #5

28 March 2014 at 11:51

Status:

Fixed

» Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Comment #6

anschinsan CreditAttribution: anschinsan commented 23 October 2014 at 14:47

Status:

Closed (fixed)

» Active

Sorry to bring this up again - but as it is a really critical bug ...

The fix in http://cgit.drupalcode.org/taxonomy_tools/commit/?id=8d68e14 fixes the bug only, when taxonomy_tools is the only module which implements hook_node_grants, (I suppose) ... As we have a setup where another module uses this hook as well, anonymous users get access but it's because of the code of taxonomy_tools module.

As seen in the other module, I would suggest to make the return of function taxonomy_tools_node_grants dependent on a permission (fEx: user_access('taxonomy_tools_nodegrants') or whatever you want to call it). I would prefer any node_access functionality respect the settings as set up on the permissions page for any role, not only for anonymous users.

#####
Edit:

I have to correct my comment: Rebuilding node access table after an update works as well. Perhaps the module should give an output indicating the the version install requires an update. Status page doesn't.