Services 6.x-2.2 + REST Server 6.x-2.0-beta3

In services.module (line 435), I'm getting an access denied error which seems to be coming from how the access callback is being defined.

It appears that as the arguments are prepped in in line 425, index 1 in $access_arguments is the $args coming in from the method call. This looks to be causing call_user_func_array to user_access (line 434) to bomb since the second arg is supposed to be $account. If I change node_resource.module (line 129) to FALSE to prevent the appending (doesn't appear as if user_access would ever care about the method args), the REST index works with no 401 error.

What I'm wondering is, is this a bug or am I somehow using the Services module incorrectly?

Comments

kylebrowning’s picture

kylebrowning commented
Status: Active » Postponed (maintainer needs more info)

I dont have a line 435 in services.module? Are you still having these issues? Can you give example data that you are sending, and receiving, that might also help me better diagnose the issue.

kylebrowning’s picture

kylebrowning commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)
Funkymoses’s picture

Funkymoses commented
Status: Closed (cannot reproduce) » Active

FWIW, I had to reinstall everything from scratch thanks to my site getting hit with malware and my site's iPhone app suddenly stopped working because node_resource became inaccessible with "access denied" responses; making this change fixed the issue. This issue seems familiar to me so I'm pretty sure I did this in the past to get it to work.

This is the code in question:
----------------------------
// Call default or custom access callback
if (call_user_func_array($method['access callback'], $access_arguments) != TRUE) {
return services_error(t('Access denied'), 401);
}
----------------------------
All calls to node_resource.index return "access denied" if I don't change this, even the ones used for testing in drupal.

kylebrowning’s picture

kylebrowning commented

It sounds to me like you are not sending your Cookie headers back, and thus are getting access denied.

Commenting out that line is a MAJOR security issue, and is NOT recommended.

kylebrowning’s picture

kylebrowning commented
Status: Active » Closed (works as designed)

You should read, http://drupal.org/node/910598

That willl get you authenticated requests and should stop your Access denied issues