Restricting Xtracker to list only permitted nodes [#48950]

Unlike the core tracker and tracker lite, Xtracker appears to list all nodes in its recent posts page, regardless of whether or not the user has permissions to list that node (no permissions to list the taxonomy term). I'm using taxonomy_access.

Is this a feature or a bug?

I took a look at each of the modules to see if I can see how they were handling their queries, but my SQL is so rusty I might as well have been trying to program with punch cards.

Patrick

Comment	File	Size	Author
#6	xtracker.module.patch.txt	611 bytes	ednique
#4	xtracker.module.patch.0	551 bytes	pcdonohue

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

bradlis7 CreditAttribution: bradlis7 commented 8 March 2006 at 17:13

I'm sure it's a bug, because if a user doesn't have access to a node, they shouldn't even know that the node exists.

Comment #2

funana CreditAttribution: funana commented 21 August 2006 at 22:27

Version:

4.6.x-1.x-dev

» master

Same in CVS. It shows all nodetypes even if the user shouldnt have access.

Comment #3

Christefano-oldaccount CreditAttribution: Christefano-oldaccount commented 2 October 2006 at 08:41

I'm looking forward to this being fixed.

Comment #4

pcdonohue CreditAttribution: pcdonohue commented 2 October 2006 at 19:46

Status:

Active

» Needs review

File	Size
xtracker.module.patch.0	551 bytes

All right,

I don't use this module anymore, but since I posted the original issue I thought I'd take a look at it again and post a fix. The included patch is against the below version.
// $Id: xtracker.module,v 1.5 2006/05/16 17:01:42 wafaa Exp $

I updated the xtracker_page function's main loop with a call to node_access for each node returned from the funtion's db query.

  while ($node = db_fetch_object($result)) {
    // check user rights
	if (!node_access('view',node_load(array('nid' => $node->nid)))) {
		continue;
	}
	// Determine the number of comments:
       $comments = 0;
...

So if the user doesn't have access privileges to view the node it skips the node while building the list of recent posts.

This seems to do the trick, but test it on your own and see if it works.

Patrick