I have run into something really weird with rc3 where views seems to ignore the "Require this Relationship" for anonymous and non-admin users, generating a NULL join for the view. The way I have narrowed down that it has got to be rc3 is by making a copy of the database and recreating the site on another server that has rc3 instead of rc1. I am trying to "hunt" down the place in the code where this happens, but that can take a while.

If there is any way I can help explain this better, please let me know.

For now I will have to "hack" the views.info to prevent the site from nagging me about a security upgrade.

Comments

jhm’s picture

jhm commented

Disabling SQL Rewriting for the view solves my problem. According to the help:

Disabling SQL rewriting will disable node_access checks as well as other modules that implement hook_query_alter().

under rc1 I did not need to disable SQL Rewriting. The reference to node_access and my initial observation about different behavior for different users indicates it might have to do with node_access ...

dawehner’s picture

dawehner
Primary language German
commented 
#
I have run into something really weird with rc3 where views seems to ignore the "Require this Relationship" for anonymous and non-admin users, generating a NULL join for the view.

Can you provide the sql which is generated? This might help to debug the issue

If there is any way I can help explain this better, please let me know.

It also helps all the time if you provide an export so it's easier to understand what you actually did. In general we wrote a document how to provide good issue information, see http://drupal.org/node/571990. This document is linked from the issue creation page so you have to know it already ;)

under rc1 I did not need to disable SQL Rewriting. The reference to node_access and my initial observation about different behavior for different users indicates it might have to do with node_access ...

Well in fact the fact that you could access the node, if you had no access to the referenced node was a security problem which got fixed, maybe you should consider your access managment.

Disabling sql rewrite is in most cases not what you want. Alternative there is an issue in the queue which allows to configure the access-tagging per relationship, but i'm not sure whether this would fix the issue for you.

dawehner’s picture

dawehner
Primary language German
commented
Status: Active » Closed (works as designed)

So i think this works as designed. I'm not really sorry for closing a potential security problem :)