I have a view that prints records of type A that have reverse references to other data of a different node type, type B. Some of the records of type A do not reverse reference any nodes of type B, and others do.

Though the view displays fine for the site superuser/admin in both the views preview and on the page itself, everyone else sees an empty page. I have the latest 3.x-dev views (12-Dec), latest 2.x-dev references (13-Dec) modules installed.

If I revert to views 3.x-dev from 12-Nov which I had installed before I upgraded, the view displays correctly. Something was committed between 12-Nov and 17-Nov that broke it, because the 3.x-dev from 17-Nov is when it stopped functioning.

When I upgraded to the latest 2.x-dev references (13-Dec) along with the 12-Dec views, there was a slight improvement. Instead of no results, now only the results that display on the page are those which have a reference. The ones that do not are not shown.

Nothing in my theme or data changed. I can quickly revert back to 3.x-dev from 12-Nov and the view displays correctly.

I'm not smart enough to track down the regression... I see a few patches in the queue that were committed and then reversed between 12-Nov and 17-Nov, but I'm not certain why the functionality did not return if the patches were actually reversed.

Any help?

Comments

dawehner’s picture

dawehner
Primary language German
commented

That's by design and was actually a bug before. If you don't have access to the referenced node you also shouldn't have access to the node itself. That's a security feature and will not be removed.

One workaround for you would be to check "disable sql rewrite" in the query settings, but be sure to know what you do here.
The actual fix for you would be to take sure that the actual node is accessible for the user.

hawkeye217’s picture

hawkeye217 commented

Interesting. Disable sql rewriting works, but the users do have access to the reverse referenced nodes... Which is why I'm still confused :)

dawehner’s picture

dawehner
Primary language German
commented

Maybe take sure that you use the really latest version of references module as well, but yeah indeed that's confusing.

hawkeye217’s picture

hawkeye217 commented

I did use the absolute latest 2.x-dev references module as of last night (datestamp in the .info file is 1323736760) with the specific views fixes recently committed, and that's when it only started to display those nodes that actually had a reverse reference as I noted in my op.

Would it make any difference that these are reverse references set up in the relationship instead of normal, "forward" references?

dawehner’s picture

dawehner
Primary language German
commented

Maybe node access get's confused by that. In general node_access seems to be fragil against really complex queries with joins.

hawkeye217’s picture

hawkeye217 commented

Yeah, there are two joins in the query...

Where do you think I should I file a bug report?

I can close this and mark it as "works as designed", especially now that I can just disable sql rewriting because all of the nodes that are involved in the query are public... Thanks much for your help.

Punchy’s picture

Punchy commented

Hello,
I've the same problem, except that is the admin role who see an empty page... and the others roles can see the display.
When I disable sql rewriting it works.
(I have the latest 7.x-3.x-dev views and latest 7.x-2.x-dev references)

dawehner’s picture

dawehner
Primary language German
commented

Mh that's sort of a problem of drupal core.

dawehner’s picture

dawehner
Primary language German
commented

On #1222324: Fix query access control on relationships (comments) there is a patch which allows to disable the addition access on relationships. Sure that's on needs work but it might help you already.

Punchy’s picture

Punchy commented

Ok, thank you !