When creating a content type, nodeaccess_node_type_insert defaults:

  // New node type, default to view for authenticated and
  // anonymous users, and all permissions for author.
  $grants[] = array(
    'gid' => 1,
    'realm' => 'nodeaccess_rid',
    'grant_view' => 1,
    'grant_update' => 0,
    'grant_delete' => 0,
  );
  $grants[] = array(
    'gid' => 2,
    'realm' => 'nodeaccess_rid',
    'grant_view' => 1,
    'grant_update' => 0,
    'grant_delete' => 0,
  );
  variable_set('nodeaccess_' . $info->type, $grants);

Which means all users may view your content.
This is very annoying, nodeaccess should not assume these settings unless the user wants it to. There's no use in providing defaults there.

This also means when using this on a fully configured site with fine grained access control, everything "opens up" to the world when enabling this module, which is a major privacy risk.

I am deliberately filing this as a bug report rather than a feature request.

CommentFileSizeAuthor
#5 nodeaccess-default_view_access-1496280-5.patch5.01 KBvlad.pavlovic

Comments

rv0’s picture

rv0 commented
Title: Don't enforce default access settings » Don't enforce default "View" access setting

changed title

and for those who want to fix it, replace 'grant_view' => 1 with 'grant_view' => 0

rv0’s picture

rv0 commented

Also same problem in install hook: (nodeaccess.install)

  $grants[] = array('gid' => 1, 'realm' => 'nodeaccess_rid',
                    'grant_view' => 1, 'grant_update' => 0, 'grant_delete' => 0);
  $grants[] = array('gid' => 2, 'realm' => 'nodeaccess_rid',
                    'grant_view' => 1, 'grant_update' => 0, 'grant_delete' => 0);;
drewish’s picture

drewish commented
Priority: Normal » Critical

Yeah I got burned by this. It's definitely buggy because the view permission bypasses the unpublished status so granting it to anon allows people to see unpublished content.

rv0’s picture

rv0 commented

I actually gave up on this module, it appeared much later that it was breaking things in my node_access table
as i just used the grant tab, i switched to an alternative module that uses a reference field to grant users access.

vlad.pavlovic’s picture

vlad.pavlovic commented
Status: Active » Needs review
StatusFileSize
new nodeaccess-default_view_access-1496280-5.patch5.01 KB

I think that setting the grant_view value for anonymous and authenticated users to 0 is equally annoying as setting it to 1, and for the same reason.

The semantically correct approach would be to base the default values on what is configured in the role permissions to start with. So if the anonymous/authenticated users have permission to 'access content', then their 'View' is set to 1, 0 otherwise.

In the same spirit since we have even more information upon installing Nodeaccess, we can also retrieve the edit and delete permissions for each content type for the anonymous and authenticated users and set the View/Edit/Delete permission defaults according to that as well.

I know that you are no longer using the module but your Issue submission deserved an answer regardless.

Attached is a patch that will address this issue, I will commit it to the dev version later today, along with a few other bug fixes.

rv0’s picture

rv0 commented

so if i understand correctly with this patch, whenever you change the role permissions, node access has to be rebuilt? thats also quite weird

vlad.pavlovic’s picture

vlad.pavlovic commented

No, these settings are the defaults that are set when Nodeaccess is installed or when a content type is created. They are pulled only at that time, same as they were before, but instead of setting View/Edit/Delete to 1/0/0 blindly (or 0/0/0 as you suggested), it checks the current configuration of the role permissions and sets the appropriate permissions according to the way the role permissions are set up.

vlad.pavlovic’s picture

vlad.pavlovic commented
Status: Needs review » Fixed

Pushed to dev, added to 7.x-1.0 release.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented
Issue summary: View changes
Related issues: +#2228713: unpublished nodes are visible

I understand this has been closed for quite some time, but I don't think this fix worked properly. After enabling this module, any content that is unpublished can be viewed by anyone. See #2228713: unpublished nodes are visible