Wrong user_access check in nodeaccess_node_access() [#2966820]

When hook_node_access is invoked by other modules (e.g. xmlsitemap module), they pass the user for which the access is checked in the $account variable. But nodeaccess_node_access(), if the node is unpublished, user_access is invoked without passing the $account as parameter, thus checking access for the logged in user. This results in returning NODE_ACCESS_ALLOW for anonymous users which is wrong.

Comment	File	Size	Author
#8	nodeaccess-wrong-user-access-check-2966820-8.patch	863 bytes	leducdubleuet
#2	nodeaccess-wrong-user-access-check-2966820.patch	895 bytes	mmrares

Comments

Comment #1

27 April 2018 at 13:19

mmrares created an issue. See original summary.

Comment #2

mmrares commented 27 April 2018 at 13:24

Status	File	Size
new	nodeaccess-wrong-user-access-check-2966820.patch	895 bytes

Comment #3

alison

she/her

commented 25 January 2019 at 22:15

Does not apply cleanly, I think bc of the extra spaces -- but the "twin" patch on #2979618: Wrong user_access in hook_node_access applies cleanly.

Comment #4

alison

she/her

commented 25 January 2019 at 22:16

Comment #5

gamboz commented 28 January 2019 at 10:38

Please note that the two patches apply to different versions of nodeaccess:
7.x-1.4 (2014) ↔ nodeaccess-wrong-user-access-check-2966820.patch
7.x-1.x-dev (2016) ↔ nodeaccess-fix_hook_node_access_for_another_account-2979618-6.patch