$node->path only set for users with admin/create access [#66642]

I'm not sure if this is a bug or if it's by design, but looking at the nodeapi hook for the path module as it is in 4.7.1:

  if (user_access('create url aliases') || user_access('administer url aliases')) {
    switch ($op) {
      // ... the validate case ...

      case 'load':
        $path = "node/$node->nid";
        // We don't use drupal_get_path_alias() to avoid custom rewrite functions.
        // We only care about exact aliases.
        $result = db_query("SELECT dst FROM {url_alias} WHERE src = '%s'", $path);
        if (db_num_rows($result)) {
          $node->path = db_result($result);
        }
        break;

     // ... other cases
  }

Why does one need create/admin access for the 'load' case to be called for our node?

Comments

Comment #1

smanes commented 17 August 2006 at 21:02

Bump on this one. I don't see why 'load' should be privileged. You may want all users to have 'path' in their template namespace even though you don't want them to create paths.

This fix seems to work.

path,module (line 204):

function path_nodeapi(&$node, $op, $arg) {
  if (user_access('create url aliases') || user_access('administer url aliases') || $op == 'load') {

Comment #2

harking commented 23 February 2007 at 19:04

Priority:	Minor	» Normal
Status:	Active	» Needs review

I would say this needs to be looked at,

It is technically a security issue if you have to enable more privileges than you need to.

Comment #3

jonathan_hunt commented 13 March 2007 at 00:03

This patch works for me on 5.1. It would be good to see it committed for 6.x and backported to 5.2?

Comment #4

Mac Write commented 6 July 2007 at 01:52

I tried adding this but get:

Parse error: syntax error, unexpected T_IF in /home/drupal/public_html/modules/path/path.module on line 214

Drupal 5.1.

Comment #5

beekerstudios commented 9 July 2007 at 16:54

I needed to be able to get the path for a custom views list, and couldn't pull the path out. I could see that as admin when doing a print_r($node) I could see the path but as anonymous I couldn't. By enabling this, it only displays the path and nothing else as far as I can tell. I can do a diff on the array, if need be. To me this doesn't seem like much a security issue. It seems like a necessary thing for custom views lists, stupid that it's not simpler.