By Shiny on

I've tried several node access restriction modules - and none of them actually restrict access.
this is on my staging server http://linuxchix.coffee.geek.nz

I have a pg_dump from production server, which i have restored onto staging each time so it's a clean database with out previous access control modules in use before i try the next module.

i've tried tac_lite, Nodeaccess, Simple Access, and Taxonomy Access Control.

The fact that all four don't work indicates something really wrong here

I've rebuilt permissions more times than i can count...

What should the node_access records look like?
Here's the record for this page: http://linuxchix.coffee.geek.nz/2007/04/17/story-test-access-control.html

linuxchix=# select * from node_access where nid = 844;
 nid | gid |     realm     | grant_view | grant_update | grant_delete
-----+-----+---------------+------------+--------------+--------------
 844 |   1 | simple_access |          1 |            0 |            0
(1 row)

This is restrictied to group which does *not* include anonymous users.
and yet, in another browser that isn't logged in, i can still access the content.

The problem exists across every node access module i've tried, so i must conclude it's not necesarily a bug in the modules themselves... but a problem with my site somewhere..

other modules installed are all from core. + mailman_manager + pathauto.

Comments

hd’s picture

hd commented

I have a very similar problem after updating to 5.1. I am using module taxonomy_access only and no other such module. After changing any of the taxonomy access permissions I find in table node_access (nid, gid, realm, grant_view, grant_update, grant_delete): 0, 0, all, 1, 0, 0. This seems to completely disable all the other definitions for taxonomy access module (realm: term_access) and makes all restricted content visible to anonymous and other user roles.

Clearly a show stopper for a site with sophisticated content access definitions based on taxonomy terms and content you do not at all want to end up in search engines.

Deleting this unwanted "0, 0, all, 1, 0, 0" row from table node_access brings things back to normal, i.e. taxonomy access is working again, until the next change in taxonomy access permissions.

I do not have this phenomena on another test site which is almost identical. I am still searching to find why one of my sites - unfortunately the one supposed to go live - is doing this.

... just found the same reported at http://drupal.org/node/126076

A rather blunt workaround is to modify node.module (version 5.1) around line 2836 replacing realm 'all' by 'whatever'. This seems to work reliably in context with taxonomy_access while - of course - not solving the underlying problem:

...
function node_access_acquire_grants($node) {
   $grants = module_invoke_all('node_access_records', $node);
   if (!$grants) {
     $grants[] = array('realm' => 'whatever', 'gid' => 0, 'grant_view' => 1, 'grant_update' => 0, 'grant_delete' => 0);
  }
...
keve’s picture

keve commented

There is a known bug in node module, that cause this symptoms when your node table is corrupted. See discussion and solution at http://drupal.org/node/125355