hook_cron() should first check if the node data being added in the database table are for a node that can be accessed from the anonymous user (aka, the search engines); differently, the search engines will start to report access for the links being added to the sitemap.

CommentFileSizeAuthor
#8 xmlsitemap-485562.patch1.62 KBAnonymous (not verified)
#3 xmlsitemap-485562.patch1.8 KBAnonymous (not verified)

Comments

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Title: hook_cron() adds node data into the module database table without first check if the node is accessible from the anonymous user » hook_cron() adds node data into the module database table without to check if the node is accessible from the anonymous user
Anonymous’s picture

Anonymous (not verified) commented
Priority: Normal » Critical
Anonymous’s picture

Anonymous (not verified) commented
Status: Active » Needs review
StatusFileSize
new xmlsitemap-485562.patch1.8 KB
dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Instead of user_load(array('uid' => 0)) use drupal_anonymous_user(). That's what actually get's loaded into global $user when the page request is anonymous, so we should use that.

Anonymous’s picture

Anonymous (not verified) commented
Status: Needs review » Needs work

Ok, thanks.

Anonymous’s picture

Anonymous (not verified) commented

Hmm... drupal_anonymous_user() doesn't load up the permissions, i.e. it doesn't give node_access() enough information about the account. Therefore user_load() needs to be used.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs work » Needs review

Yes it does. It loads the correct user roles, which are used in user_access for permissions.

  $user->roles = array();
  $user->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';
Anonymous’s picture

Anonymous (not verified) commented
StatusFileSize
new xmlsitemap-485562.patch1.62 KB

Here's what I've come up with that works. I don't like the fact that I've to do the node_load() for the node_access(). Any suggestions?

I had to remove the db_rewrite_sql because it didn't return the correct rows.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented

db_write_sql() doesn't return the correct rows because it verifies the access permission against the actually logged in user, not the anonymous user.

node_load() is necessary for node_access() to properly work because a single module can need the extra fields it adds, to verify if the user has the permission to operate on the passed node.

The code seems fine, to me.

Anonymous’s picture

Anonymous (not verified) commented
Title: hook_cron() adds node data into the module database table without to check if the node is accessible from the anonymous user » Node links are added to sitemap.xml without checking anonymous access
Status: Needs review » Fixed

Committed to CVS.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.