Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.If you run
dpm($account) within user_access() after if (!isset($perm[$account->uid])) {
You will see "access content", which is a string.
But a few lines later it's attempting to be passed into a mysql query as $account->roles, which is blank.
Here are the errors:
warning: array_fill() [function.array-fill]: Number of elements must be positive in /public_html/includes/database.inc on line 253.
warning: implode() [function.implode]: Invalid arguments passed in /public_html/includes/database.inc on line 253.
warning: array_keys() expects parameter 1 to be array, null given in /public_html/modules/user/user.module on line 530.
user warning: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1 query: SELECT p.perm FROM drupal_role r INNER JOIN drupal_permission p ON p.rid = r.rid WHERE r.rid IN () in /public_html/modules/user/user.module on line 530.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | user-access-roles-1472268.patch | 580 bytes | tayzlor |
Comments
Comment #1
tayzlor commentedComment #2
tayzlor commentedattaching a patch which adds checks to establish if roles are set on the user object and if $account->roles is an array.
Comment #3
tayzlor commentedComment #4
BrockBoland commentedI can't replicate this, and I'm not sure where you're seeing the issues you report.
$account->rolesisn't being passed into a query without being checked:user_role_permissions()will build an array of roles, if there are any available, and use them in a query, but it does check for values before doing so. Furthermore, line 530 inuser.moduleisn't a query, in 7.12 or 8.x.Needs clarification or more info from rickmanelius.
Comment #5
BrockBoland commented(I should refresh before I post comments)
tayzlor, have you been able to replicate this?
Comment #6
rickmanelius commentedApologies, I should have created a better scenario to recreate. But regardless of recreating, you can throw a dpm() call in there to see that it's not making it into the query as an array.
Comment #7
tayzlor commentedWas not able to reproduce exact issue described. Weirdness does happen if $account is not a user object (function being called incorrectly - which would not happen in core anyway). Added some defensive coding anyway, but could argue that it is not even necessary.
user_role_permissions already checks if $fetch is set anyway, so we could just close this? cannot see how the mysql bug can possibly happen.
Comment #10
dpiThis will no longer happen in D8 since
$user->getRoles()is guaranteed to return an array.The problematic query no longer exists in D7, and it also appears that role is always an array in D7, and it is prepopulated with authenticated or anonymous roles (See
\UserController::attachLoad)See also #777116-47: Empty $account->roles causes a sql error in user_access