Gallery teasers are viewable by users whom Content Access denies node view permission

I ran into the same issue that Content Access would allow a user to see the gallery in the All Galleries page, but would block a user from viewing the gallery by displaying an Access Denied page when viewing a protected gallery.

I expected that galleries that should not be viewed by the user should not be displayed.

I tracked the issue to the following function in media_gallery.module:

function media_gallery_select_galleries($tid, $pager = TRUE, $limit = FALSE)

This function pulls a list of node ids of all the galleries.

This query pulls from the taxonomy_index table and not the node table. I think this was preventing the node_access tag to retrieve accessible nodes.

$query = db_select('taxonomy_index', 't');

I have rewritten the function to pull from the node table. I would write a patch, but not too familiar with git yet.

<?php
function media_gallery_select_galleries($tid, $pager = TRUE, $limit = FALSE) {
  if (!variable_get('taxonomy_maintain_index_table', TRUE)) {
    return array();
  }
  $query = db_select('node', 'n');
  $query->leftJoin('media_gallery_weight', 'mgw', 'mgw.nid = n.nid AND mgw.tid = :tid', array(':tid' => $tid));
  $query->leftJoin('taxonomy_index', 't', 't.nid = n.nid');
  $query->addTag('node_access');
  
  $query->condition('t.tid', $tid);
  if ($pager) {
    $count_query = clone $query;
    $count_query->addExpression('COUNT(t.nid)');

    $query = $query->extend('PagerDefault');
    if ($limit !== FALSE) {
      $query = $query->limit($limit);
    }
    $query->setCountQuery($count_query);
  }
  else {
    if ($limit !== FALSE) {
      $query->range(0, $limit);
    }
  }
  
  $query->addField('n', 'nid');
  $query->addField('t', 'tid');
  $query->addField('mgw', 'weight');
  $query->orderBy('mgw.weight', 'ASC');
  $query->orderBy('n.nid', 'ASC');
  $result = $query->execute();
  return $result->fetchCol();
}
?>

Thanks for digging in. A patch and testing results from others would be very helpful.

I have created a patch against the beta5 release. This is my first patch hope I did it correctly.

This bug was due to a security issue in Drupal core, fixed in Drupal 7.3 (SA-CORE-2011-002).

I just checked now that I was able to reproduce the problem using Drupal 7.2, but not using Drupal 7.3 (or higher). So, this is fixed. Thanks for everyone's work looking into it, though!