Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
Marked as critical because this could completely break websites' layout and potentially disclose data that should not be disclosed. (Security issue?)
Steps to reproduce:
- Create a new website with one dummy Article node
- Add a view which displays Article nodes as a block on a node page
- Add a template named node--view--view-name.tpl.php to your theme (not node--view--view-name--block.tpl.php)
- Add the block to any region
- Go to /node/1 and watch how your main node is also displayed in the view template instead of node.tpl.php or node--article.tpl.php or whatever.
- Same goes for users
Reasoning behind the bug:
- views_plugin_row_node_view:render() sets $node->view to the view so node_view() on the next line will have the correct data for views_preprocess_node()
- However, it does not respect the fact that any entity comes from an internal cache, thus leaving the $node polluted with the 'view' property
- This in turn causes the node that should make up the page content to also trigger alterations in views_preprocess_node()
Plausible fixes to the bug:
- Unset the 'view' property right after calling node_view() (patch a)
- Load all nodes for the plugin using
$reset = TRUE
(patch b)
Comment | File | Size | Author |
---|---|---|---|
#1 | views-2359955-1b.patch | 1.67 KB | kristiaanvandeneynde |
#1 | views-2359955-1a.patch | 1.58 KB | kristiaanvandeneynde |
Comments
Comment #1
kristiaanvandeneyndeAttached are both patches, I've successfully implemented patch b on my website.
Comment #2
kristiaanvandeneyndeComment #3
MonsterCache CreditAttribution: MonsterCache commentedI am facing the same problem now wit the latest Drupal 8.2.7 version.
To reproduce the problem :
Comment #4
DamienMcKennaThis needs tests to clearly document the issue, and might have to move to a core issue first.
Comment #5
DamienMcKennaComment #6
andeersg CreditAttribution: andeersg at Bouvet commentedI believe at least the Drupal 8 problem from comment #3 is related to this: https://www.drupal.org/node/2728419