Hi there! I was testing some core updates (from 7.50 to 7.51) and noticed a few of my content views had ceased pulling results for users that had specific node grants (for custom content access) issued to them. Has anyone else run into this since the last core update? I am using the latest views module version 7.x-3.14

I did a little digging but I'm limited in how far I've been able to go based on my limited developer knowledge on drupal queries and some of the inner-workings of views. I first checked to see if my custom content access with the node grants had been broken elsewhere, but these users with the grants were able to view, create, update, delete the nodes they should have had access to and everything seemed to work normally, which is why I don't thing the problem is the node grants. But when it came to looking at content lists created by views this content was not listed as being available (no node results) to them unless I disabled the SQL rewrite in the view's query settings.

I took a closer look at the code that changed in the node.module file with the core update and there appears to be changes made in the node.module (/modules/node/node.module) to the function _node_query_node_access_alter() on line 3457.

Here is what was there in core 7.50:

         // If it's a left join to entity table and entity does not exist (i.e. + $query->exists($subquery);
         // entity_id is null) then skip access check.		
         if ($tableinfo['join type'] == 'LEFT') {		
           $subquery_cond = db_or();		
           $subquery_cond->exists($subquery);		
           $subquery_cond->isNull("$nalias.$field");		
           $query->condition($subquery_cond);		
         } else {		
           $query->exists($subquery);		
         }

And this code has been replaced in 7.51 by:

     $query->exists($subquery);

Just to experiment and test things out I reverted only the node.module file, kept all other changes with the update, and then the nodes appeared in the views as if the node access check was working properly once again. Sadly I don't quite know what to do from here. I tried searching for similar issues and patches, but couldn't find anything quite like this, or any workarounds as far as I could see.

Any advice would be much appreciated, I am not sure if I might have found a bug with views and core 7.51 or if there's something I'm completely missing.

Thanks!

Comments

Poindexterous created an issue. See original summary.

Poindexterous’s picture

Title: views node_access chekcing seems broken after core update 7.51 » views node_access checking seems broken after core update 7.51
Poindexterous’s picture

Status: Active » Closed (works as designed)

My apologies, I just found out that at some point we had patched the node.module, and it was overwritten in 7.51 (node-sql-rewrite-1969208-28). Closing this one out.