The call to node_access() in the function node_submit contains an error in its arguments.

A call to node_access is supposed to specify a node type as the second argument when the first is "create", but the call is specifying the node object.

This can be fixed by changing the line:
if (node_access('create', $node, $account)) {
to
if (node_access('create', $node->type, $account)) {

Cheers.

Comments

ilo’s picture

ilo commented
Status: Active » Closed (works as designed)

Hey, thanks for the report, but..

http://api.drupal.org/api/drupal/modules--node--node.module/function/nod...

6 – 8 node_access($op, $node, $account = NULL)

Parameters

$op The operation to be performed on the node. Possible values are:
$node The node object (or node array) on which the operation is to be performed, or node type (e.g. 'forum') for "create" operation.

Not sure what you mean, sorry.

jayelless’s picture

jayelless commented

Hi Ilo,

Just to clarify my comment. The documentation for function "node_access" clearly states (as referenced by you) that the second parameter is expected to be a "node type" when the operation is "create".

The line referred to in the function "mailhandler_node_submit" uses the $node object in the call to "node_access" with the operation "create".

Using a node object (or node array) in this context does not satisfy the documented interface, and so the call to node_access returns an error condition.

These error conditions are resolved by making the change I describe so that the call to "node_access" satisfies the interface requirements.

ilo’s picture

ilo commented
Version: 6.x-1.11 » 6.x-1.x-dev
Status: Closed (works as designed) » Needs work

Yes, clearly I see your point, but I can't find any of these errors you mention. Actually, the following Core call also uses a full node object, despite the function signature (check the first line of the function):

http://api.drupal.org/api/drupal/modules--node--node.pages.inc/function/...

However you are right, there are other core function calls using a single string. The fact is that core supports $node being an object (take a look at node_content_access(), but other implementations of hook_access might fail, so I assume that these errors that you mention come from other node access control modules (or modules providing custom custom content permissions).

I totally agree that your proposed change must be included.

danepowell’s picture

danepowell commented
Component: Code » Mailhandler
Status: Needs work » Closed (won't fix)

Sorry, 6.x-1.x is no longer a supported release. Please try upgrading to 6.x-2.x and reopen if still an issue.