In a multi-site installation where the tables of all sites have prefixes, in the respective tables prefix_sequences an entry acl_id with the value of 1, but without prefix is created. However, there is no table acl, there are only three different tables with prefixes: e_acl, m_acl, and w_acl.

The expected entries also all exist, i.e.:

  • Table e_sequences: entry e_acl_id
  • Table m_sequences: entry m_acl_id
  • Table w_sequences: entry w_acl_id

However, in these tables from time to time the wrong entry acl_id with a value of 1 appears. This has happened repeatedly after I deleted this entry manually.

It is not certain that the ACL module causes this, but I cannot find out. I have also not found out whether the false entry is only a harmless fluke or whether it is an indication of wrong access rights being assigned. Since this could cause security breaches, I have given the issue a high priority.

Hans-Georg Michna

Comments

hgmichna’s picture

hgmichna commented
Title: In table sequences an entry acl_id without table name prefix is created. » Looks pretty bad to me.

On further investigation I noticed that in one of the multiple sites there are these entries in w_sequences:

  • Field w_acl_id, value 3 (This is the expected field.)
  • Field acl_id, value 4 (This is the field that should not be there.)

The highest acl_id in table w_acl is 4. (This indicates that the field w_acl_id should have the value 4 or higher, but not 3.)

Add to this the confusing fact that the naming of the field w_acl_id does not follow the convention tablename_fieldname, because it should actually be named w_acl_acl_id, because the field in the table w_acl is, rather redundantly, named acl_id.

Don't drink and code! (:-)

Hans-Georg

hgmichna’s picture

hgmichna commented
Title: Looks pretty bad to me. » In table sequences an entry acl_id without table name prefix is created.

Reset title, which I mistakenly changed.

hgmichna’s picture

hgmichna commented
Status: Postponed (maintainer needs more info) » Fixed

In response to the recommendations given by the author, merlinofchaos, at http://drupal.org/node/159108 (Forum Access), I successfully patched the ACL module. This patch also solves the problem outlined in http://drupal.org/node/159134.

The bug befalls multi-site installations that use tables with different prefixes for the different sites in one database. It corrupts the acl tables such that an automated repair is difficult or impossible.

----- Patch instructions -----

1. Switched all sites of the multi-site installation into maintenance mode.

2. Disabled the modules

In each site I disabled first the Forum Access module, then the ACL module. (This may not be necessary, as their entries are later deleted in the system tables, but I didn't know that at the time and am still not quite sure.)

3. Patched the ACL module

In the file acl.module I inserted: {acl}_

The result looks like this:

function acl_create_new_acl($module, $name) {
$acl_id = db_next_id('{acl}_acl_id');

4. Deleted the tables

As the information in these tables was already corrupted, I dropped all acl and forum_access tables for all sites.

5. Deleted the sequences acl_id entries

In the sequences table of each site I deleted the correct and incorrect acl_id entries.

6. Deleted the system module entries

To force a re-installation along with the recreation of the tables, in the system table of each site I deleted the two entries for the acl and forum_access modules.

7. Re-enabled the modules

For each site I re-enabled first the ACL module, then the Forum Access module. Drupal reports the recreation of the tables.

8. Re-entered the forum access settings

For each site and each forum container and forum I re-entered the access rights settings. This took the most time.

9. Switched off maintenance mode

In each site I switched off the maintenance mode.

----- End of patch instructions -----

The procedure would have been simpler if the modules had an uninstall function that deleted the tables and the sequences entries.

Thanks for providing these very useful modules in the first place!

Hans-Georg

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)