Steps to reproduce:

1. Log in as the superuser.

2. Enable Blog module.

3. Go to /blog/N, where N is the ID of a user who exists, but hasn't created any blog posts yet.

4. Get "Access denied" error.

It seems to be that it should either be a custom message (such as "This user has not yet created any blog posts") or at least a "Page not found" error.

Comments

furamag’s picture

furamag commented

tgeller, I don't think this is a bug. I think user with id N doesn't have permissions to create Blog entry content. User should have permissions to create blog posts or should have at least one blog entry. If user doesn't have blog posts and can't create blog entry content any another users can't see page /blog/N .

tgeller’s picture

tgeller commented
Title: Superuser gets "Access denied" error when attempting to read empty blogs » Change error message when attempting to access non-existent blogs
Priority: Normal » Minor

You are correct, furamag! If I allow the user (i.e., authenticated users) to create blog posts, I get the following message instead: "testuser1 has not created any blog entries." Much more helpful.

I still think a message other than "Access denied" would be helpful, perhaps "testuser1 is not permitted to create blog posts". I've changed the issue's title to reflect that, and also changed the Priority to "minor".

(The original title of this issue was "Superuser gets "Access denied" error when attempting to read empty blogs".)

agerson’s picture

agerson commented

When I try this I get "Page not found" which sounds appropriately descriptive.

tgeller’s picture

tgeller commented

agerson, I just checked it again: I still get "Access denied" when trying to access the blog of a user who doesn't have permission to create them (in D7).

Could you provide the steps you used to get the "Page not found" message? I suspect we're talking about different things.

furamag’s picture

furamag commented

I tested this page one more time and I get "Access denied". I can't recreate issue reported by agerson.

WebNewCastle’s picture

WebNewCastle commented

My understanding of what is reported here is the issue I was going to report when I found this in the queue. I don't know if the issue is a bug per se or a "as designed" item that should be changed.

Perhaps the specific scenario I found will help illustrate the issue that I think is the same as was initially reported on this thread.

- Let's say Role A is given permission to create blog entries (aka "have a blog") and User/3 has Role A.
- Let's say Role B does not have such permissions and User/4 has Role B.
- Let's also say that the site currently does not have a single blog entry.

The above are examples.

In the above, going to /blog/3 gives a message that User name such and such "..has not created any blog entries". That makes sense.

But, going to /blog/4 gives an Access Denied error (whether logged in as super admin, not logged in, etc.) - and that doesn't make sense.

It's not an access issue, so I don't think it should lead to an access denied message. In this case, /blog/4 doesn't exist because that user is not allowed to create blog posts / have a blog, so it's more of a "Not Found" situation.

In the comments of the particular access callback, it includes "For a blog to 'exist' the user must either be able to create new blog entries,". I think, actually, for a blog to exist - it first needs to actually, well, exist, and at this level not be related to whether that particular can create blog posts.

The access denied message suggests that the person getting the error message is trying to access actual content but does not have the permissions to do so rather than the actual situation that the content in question simply doesn't exist.

WebNewCastle’s picture

WebNewCastle commented

My bad. When I went to add to this existing issue instead of creating a new one, I failed to notice it was marked as Version 7.x-dev. What I've reported is from 6.19. If someone knows that I need to just create a new issue, please let me know.

VladGh’s picture

VladGh commented

Is there a hook, a function that I can use inside o module to force Drupal (7.8) to show a 404 error instead?

m1r1k’s picture

m1r1k commented
Priority: Minor » Major

When we're passing string instead of integer as a second url argument (/blog/blabla) drupal has to return 404, as other ENTITY_load functions do. (e.g. check https://drupal.org/user/blabla). I have site with such URL pattern for blog nodes (blog/[node:title]) and get 403 on wrong page instead of 404. Also maybe it is user module's bug.

thedosmann’s picture

thedosmann commented

Is this a correct response to a non-existent blog/whatever - a 403?

On my site my blog content is pathed to content/blogtitle

The only blog path is the main site/blog, all other blog content is content/blogtitle
A user blog would be site/blogs/username and lists all blogs of that user. Still, clicking on a blog title will go to site/content/blogtitle.

If a path like site/blog/whatever is used, then a 403 is returned.
This is bad as it causes spam bots to think spam they tried to add was added and is hidden behind a login. A 404 should be returned.

I just now uncovered this and it is a serious issue. It can cause a tremendous amount of spam driven traffic to non-existent pages.

I'm on 7.25 but I believe it is true for dev also

I'm using m4032404 to circumvent this bug

Status: Active » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.