node_validate does not respect group editing [#11071]

With the new node-level access permissions, it is entirely possible for users in the same role, or having the same taxonomy term to edit each other's nodes. However when this happens, node_validate will transfer ownership of the node to the user who last edited it. I think this behavior should be changed so that original authorship is always maintained unless specifically transferred.

The problem lies in node_validate, here:

$node->uid = $user->uid ? $user->uid : 0;

Since an alteration such as this could introduce an exploit, I'm wondering what other's feel would be the best solution?

I was working on a role-based editing permissions module (based on JonBob's nodeperm_role.module) where the author of a node controls which groups can view/edit their post.

Comment	File	Size	Author
#1	node_perm.patch	655 bytes	matt westgate

Comments

Comment #1

matt westgate commented 25 September 2004 at 21:34

Status	File	Size
new	node_perm.patch	655 bytes

Here is a proposed patch, which would then allow node authors to choose which users could view/edit their post.

Comment #2

moshe weitzman commented 21 December 2004 at 16:42

seems simple enough to me. we ought to protect against unintentially changing the author, right? +1

Comment #3

dries commented 27 December 2004 at 09:16

Hopefully, this will become easier/clear as soon the revisions patch hit CVS. Let's revisit this soon.

Comment #4

tangent commented 23 February 2005 at 05:52

As requested in this issue, it may be desirable for users with the permission to do so to change the owner of a node.

Comment #5

dries commented 8 March 2005 at 20:57

Waiting for the node revision patch to land.

Comment #6

killes@www.drop.org commented 14 August 2005 at 01:11

Status:

Active

» Needs review

This patch still applies. I don't immediately see why this is related to the revisions patch.

Comment #7

moshe weitzman commented 17 December 2005 at 01:17

is this still needed?

Comment #8

chx commented 17 December 2005 at 01:32

moshe, I think yes, as the offending line is stll in node_submit. Dries probably hoped that different revisions may have different uids. The possibility is there (look node_save and node_table_values and revisions_table_valuesIMO but that would require some study. For example, how should node access react to this?

matt's patch could be written a bit more elegant IMO so that it reads isset($node->uid) ? $node->uid : $user->uid .