Set up: I have a locked of library section on my website (ex. www.website.com/librarysection) that requires a login to get access to. Rules is set up to redirect any anonymous user to the login-page. So it filters on role and text comparison (text:[node:url] to /librarysection and /librarysection/*).

I use the core searchmodule and rules 7.x.2.12

Problem: I have noticed that when I search (anonymously) for certain keywords that are also contained in the librarysection and/or one of it's titles, then my search results will redirect to the login-page. This is not meant to happen; the library-hits are supposed to show up in the results with the other not-locked site-entries and only on click refer to the login if anonymous.

Instead of giving me www.website.com/search/node/term and all subsequent results (locked or not), the search link becomes: www.website.com/user/login?destination=search/node/term and I get my login-page. (The 'user/login?destination' is my redirect to login from the rules and then to the original page)

I found this similar topic from a few years back: https://www.drupal.org/project/rules/issues/1991826

I looked over the comments and thought #8 could fix my problem but i don't really understand how to implement it. I know I need to make a component but can't really figure out which plugin-type and variables I need and how to set it up with my original rules.
(I know comment #3 offers a different solution, but I want to avoid installing a module if it can be done within Rules and also it's not covered by drupal policy)

Can someone please help either by explaining or by suggesting other possibilities? Or should I try comment #3?
Thanks!

Comments

ElineK created an issue. See original summary.

ElineK’s picture

ElineK commented
Issue summary: View changes
tr’s picture

tr commented

Trying to control access to a node by blocking a path is guaranteed to fail, because content may be accessed in many ways other than its "official" path. Search is just one of those ways. Views is a another (including the standard /node view), file attachments another, path aliases another. Additionally, changes to your site in the future may expose other ways that your "protected" content is exposed. Using a path is not a proper way to control access.

If you want to control access, you need to use Drupal's built-in access control mechanisms. There are dozens of modules that allow you to control access properly, using different criteria. See https://www.drupal.org/node/270000 for example.

Rules may be used to play a part in the workflow of restricting access using those modules, for example by using Rules to assign taxonomy terms used by taxonomy access control, but Rules should not be used to try to restrict access based on path, because that will never work completely.

ElineK’s picture

ElineK commented

@TR: thanks for your response.

I am using Node and Access control to block things off. The rules module is just used for redirecting to the login-page, showing a login-message and such. I don't want the customers stuck on an 'access forbidden' page.

But Rules is blocking my search results from showing up, that's what I want to fix.

tr’s picture

tr commented
Status: Active » Postponed (maintainer needs more info)

Export your Rule and post it here.

ElineK’s picture

ElineK commented

I hope this helps:

Rule for the main subpage

{ "rules_extranet_hoofdpagina" : {
"LABEL" : "Extranet hoofdpagina",
"PLUGIN" : "reaction rule",
"OWNER" : "rules",
"TAGS" : [ "extranet-leden" ],
"REQUIRES" : [ "rules" ],
"ON" : { "node_view--page" : { "bundle" : "page" } },
"IF" : [
{ "AND" : [] },
{ "user_has_role" : {
"account" : [ "site:current-user" ],
"roles" : { "value" : { "1" : "1" } }
}
},
{ "text_matches" : { "text" : [ "node:url" ], "match" : "\/extranet", "operation" : "ends" } }
],
"DO" : [
{ "redirect" : { "url" : "user\/login?destination=node", "destination" : "1" } }
]
}
}

Rule for all other subsection pages:

{ "rules_extranet_leden" : {
"LABEL" : "Extranet leden",
"PLUGIN" : "reaction rule",
"OWNER" : "rules",
"TAGS" : [ "extranet-leden" ],
"REQUIRES" : [ "rules" ],
"ON" : { "node_view--page" : { "bundle" : "page" } },
"IF" : [
{ "user_has_role" : {
"account" : [ "site:current-user" ],
"roles" : { "value" : { "1" : "1" } }
}
},
{ "AND" : [] },
{ "text_matches" : {
"text" : [ "node:url" ],
"match" : "\/extranet\/[a-z0-9_-]\\w+",
"operation" : "regex"
}
}
],
"DO" : [ { "redirect" : { "url" : "user\/login", "destination" : "1" } } ]
}
}

tr’s picture

tr commented

You are reacting on the event "node_view--page", which operates the same as hook_entity_view():
https://api.drupal.org/api/drupal/modules%21system%21system.api.php/func...
function hook_entity_view

Acts on entities being assembled before rendering.

So yes, what you describe is the expected behavior for the way you are doing this. If you turn on Rules debugging you will see that there is an event for every page node that is being rendered in the search result, so if any of them meet your conditions your redirect will happen.

If you don't want this, then you can add another condition, for example to check on the path to see if you're on the search result page. Or you could use a different event.

tr’s picture

tr commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

No further information provided.