I couldn't get another module to work correctly (CKEditor) and after lots of debugging found this issue:

views_plugin_argument_validate_user.inc line 98:

      $account->roles = array();
      $account->roles[] = $account->uid ? DRUPAL_AUTHENTICATED_RID : DRUPAL_ANONYMOUS_RID;
      $result = db_query('SELECT rid FROM {users_roles} WHERE uid = %d', $account->uid);
      while ($role = db_fetch_object($result)) {
        $account->roles[] = $role->rid;
      }

This causes a permission problem in the CKEditor module. But it seems like a major problem in the Views module, for two reasons:

1. It populates the roles array with no concern for RIDs as array keys. Many other modules rely on the keys of $account->roles to indicate the RID.
2. It populates the roles array of the account object even though these roles are already set. This leads to unnecessary db queries.

I checked out the latest dev version and the same code is still there (but on line 108).

Am I missing something? Any explanation for this code?

Comments

dawehner’s picture

dawehner
Primary language German
commented
Status: Active » Fixed

This is fixed already in 6.x-2.x-dev

olbion’s picture

olbion commented
Status: Fixed » Active

I downloaded 6.x-3.x-dev. Looked at modules/user/views_plugin_argument_validate_user.inc line 109:

      $account->roles[] = $account->uid ? DRUPAL_AUTHENTICATED_RID : DRUPAL_ANONYMOUS_RID;
      $result = db_query('SELECT rid FROM {users_roles} WHERE uid = %d', $account->uid);
      while ($role = db_fetch_object($result)) {
        $account->roles[] = $role->rid;
      }

Then downloaded 6.x-3.0-alpha3. Same file, line 105:

      $acccont->roles = array();
      $account->roles[] = $account->uid ? DRUPAL_AUTHENTICATED_RID : DRUPAL_ANONYMOUS_RID;
      $result = db_query('SELECT rid FROM {users_roles} WHERE uid = %d', $account->uid);
      while ($role = db_fetch_object($result)) {
        $account->roles[] = $role->rid;
      }

Then 6.x-2.12. Same file, line 99:

      $account->roles[] = $account->uid ? DRUPAL_AUTHENTICATED_RID : DRUPAL_ANONYMOUS_RID;
      $result = db_query('SELECT rid FROM {users_roles} WHERE uid = %d', $account->uid);
      while ($role = db_fetch_object($result)) {
        $account->roles[] = $role->rid;
      }

So in which version do you mean that this is fixed?

merlinofchaos’s picture

merlinofchaos commented
Status: Active » Fixed

All of them. $account is a local variable not shared with other modules.

You should read *all* of the code.

dawehner’s picture

dawehner
Primary language German
commented

There is a bug in 6.x-2.x, which changes $user.

olbion’s picture

olbion commented
Status: Fixed » Active

I upgraded to 6.x-3.0-alpha3 and it solves the bug affecting CKEditor.

Thanks for your help. I still think the code is imperfect since it populates $account->roles in a non-standard way.

olbion’s picture

olbion commented
Status: Active » Fixed

Sorry, didn't mean to reopen the issue.

merlinofchaos’s picture

merlinofchaos commented

I agree, it should be bothering with $account at all, but it does not affect anything outside of itself, so it's just silly code and not really a bug at all.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

oswajas’s picture

oswajas commented

See also #832954: global $user->roles get changed by argument_user_validate.

oswajas’s picture

oswajas commented

See also #832954: global $user->roles get changed by argument_user_validate