If a node is accessed directly, the permission system doesn't seem to work.

I have a book entry for which viewing is only allowed for authenticated users. Now I access my homepage with an anonymous user. When I look at the book, links to the page, for which I disabled viewing with an anonymous users, are not displayed. So far, so good. However, if I type in the address to that page directly ( i.e.: http://myhost/node/15 ), the page is displayed. :(
Either I misunderstood the way this module should work, or... it does not work correctly.

Comments

ankur’s picture

I have not been able to reproduce the error. Please make sure that the module is also enabled in the module's own settings page ('admin/settings/node_privacy_byrole').

bpkri’s picture

Priority: Critical » Normal

I have additional information:
The module of course is enabled, but my statement is ONLY true for nodes, which belong to a book as it seems.
Here is what I did:
I create a category with two terms "a" and "b". As node types for the category I selected only book nodes. Now, I created a new book page, with content and select the first term of the category I created ("a"). I allow for everyone to read it. Everything is fine here.
I add another book page, also assign category "a", fill it with some content. As parent of this page I select the page I already created. This page is NOT visible by anonymous users. Sadly, when I log out, its content is still visible. You can see it here: http://secrets.pirotesse.de/node/4
Yet - I also created a normal page: http://secrets.pirotesse.de/node/5 - this page does not belong to any category and is not a book page. It's only a page. The permissions work correctly here.

Set priority to normal due to only book pages affected.

bpkri’s picture

Okay - here's some more information:
I toyed around with phpmyadmin and the node privacy byrole module some more and found something out:
The first thing I tried is create a normal page with content, and not allowing anonymous users to see it. I know this works.
verified it, by logging out and trying to access the page -> access denied. Wonderful.
The next step was now: Assign this page to a book by editing it again and using the outline feature. And see: It still works! Anonymous users cannot acces the page. Now, what's the difference?
Checking the "node" table with mysql I saw a difference: The type is different. For nodes created as book pages the type is "book". For nodes created as normal pages the type is "page". I toyed around by changing the value of "type" for a node entry from "book" to "page" and see: anonymous users can't access it anymore. Maybe this information helps?

bpkri’s picture

Title: Permissions not working when directly accessing a node » workaround: add new node as page

Here's a workaround:

To add nodes to a book, you can "simply" add a new node as page - and not as book page! Fill it with content and submit it. After you have done that, you can go back to that page, edit it, and add it to the book via the outline function.

bpkri’s picture

Title: workaround: add new node as page » Module does not work correctly for node type "book"

Just re-setting the title, so bug description matches content. Workaround see above.
Maybe this is a problem in drupal or the book module rather than in this module? I don't know enough about PHP and drupal to understand the way things work.

Anonymous’s picture

Howdy,

I looked into the problem with taxonomy and book pages when using node_privacy_byrole and it seems that there are some consistency issues between 'publishing' a book page and using it with taxonomies. This may be an issue with per-node settings or with taxonomy. If there is something that should be modified in node_privacy_byrole, I will look into it. If it's a change that correctly belongs in a different module, I'll forward the issue to the maintainer of that module. However, for now, you may want to fall back on the workaround.

-Ankur

Anonymous’s picture

I am seeing the same problem, but I am also seeing it with "page" nodes once they are added to a book outline; even if I later remove them from the book, they remain visible. this should not be visible to anonymous users.

Anonymous’s picture

Same Anonymous as immediately above (why can drupal.org not manage to remember I have an account?). My problem appeared to be a conflict between taxonomy_access and node privacy byrole modules. Both maintainers may wish to document that the modules are incompatible.

tlindgren’s picture

I have the same problem: "If a node is accessed directly, the permission system doesn't seem to work" for several module besides book pages. I've been testing a couple of different sites on different servers (all 4.5) and this is what I came up with:

When accessed directly, the permission system worked for these node types:
page
blog

When accessed directly, the permission system did not work for these node types:
book
event
image
flexnode

Can anyone corroborate this? I really love this module, but I need to be able to prevent direct access in some cases. Any help would be greatly appreciated.

Tim

tlindgren’s picture

I forgot to mention that I'm not using taxonomy_access, so there's now conflict with that module in my case.

Tim

register’s picture

My problem is somewhat different, but it does have to do with the book module and I do have several categories setup to use with book pages. The problem I'm having is that user roles given edit privileges are unable to edit. Although I can give editing permissions to roles when creating new book pages, the role users are unable to edit the book pages.

nautilebleu’s picture

I confirm the bug with the book type. I create two roles, X and Y. I want that users with X can only edit X docs and vice-versa. It works with page type, but if I add a page to a book, the permission controls dissapear.

moshe weitzman’s picture

this was a bug in book.module which was fixed in 4.5.2 for the View operation. The Edit operation is still not fixed, though I have submitted a patch forr core.

ankur’s picture

Try the latest version from the CVS... With the previous version, permissions were not being set the way the node system intended. If this doesn't solve the problem, please refresh this thread with another post here.

-Ankur

ankur’s picture

This was a problem with book.module that has since been fixed.

-Ankur

ankur’s picture

It appears that this was a problem with the way that the book module was handling permissions for it's parent-children relations for node_access rights.

A patch has been submitted to core.

My advice: upgrade to 4.6 and use what's in the CVS, though I would qualify this recommendation with "wait until the module is tagged for 4.6" which will be soon enough...

-Ankur