Anonymous users can't access anything under /blog.

A fresh install:

Drupal 6.0-beta1
Access to update.php Protected
Configuration file Protected
Cron maintenance tasks Last run 29 min 40 sec ago
You can run cron manually.
Database schema Up to date
Drupal core update status Up to date
File system Writable (public download method)
GD library 2.0 or higher
MySQL database 4.1.11
PHP 4.3.10-22
Unicode library PHP Mbstring Extension
Web server Apache/2.0.54 (Debian GNU/Linux) PHP/4.3.10-22

CommentFileSizeAuthor
#3 blog-menu-01.patch3.67 KBdesbeers

Comments

stborchert’s picture

stborchert
he/him
Primary language German
commented

Tried to reproduce: /blog is accessible but /blog/1 isn't.
If you set "edit own blog" for "anonymous user" to true (admin/user/access) anonymous user can access all blogs.
Strange behavior that should be documented somewhere.

mejd’s picture

mejd commented
/blog is accessible but /blog/1 isn't.
Yes. Got the same results on an upgraded site which worked fine under 5.2.
If you set "edit own blog" for "anonymous user" to true (admin/user/access) anonymous user can access all blogs.
That worked but is different from 5.2 and earlier and has some unfortunate consequences. The navigation menu now includes an entry for anonymous users that links to /blog/0 --- not much use. This still looks like a bug to me.

Additionally the uid for /blog/<uid> doesn't filter blog entries by user; it shows all entries. Also every user's blog is labelled "My Blog". This is independent of the access restrictions snafu. Should I submit a new issue?

desbeers’s picture

desbeers commented
Title: Blogs not accessible to anonymous users » User-specific blogs pages and feeds not accessible
Priority: Normal » Critical
Status: Active » Needs review
StatusFileSize
new blog-menu-01.patch3.67 KB

Problem appears with the split of the blog.module (http://drupal.org/node/159634) that is re-factoring the menu callbacks as well.

The main problem is in the the blog_menu() function. There is a new entry for accessing own blog page; overriding the 'normal' user page (who uses blog/$user/view; something I don't understand). For this entry 'edit own blog' permission is necessary.

Second, %user is used now in the menu and that gives an array of the user; so no need to load them again in the 'blog_page_user' and 'blog_feed_user' functions.

Thirth, blog_page_user is never called. It's blog_page_last instead and that's why it shows all entries.

I removed the 'own blog' entry and altered the 'general' blog/$uid entry to pass an argument. Now all works well; including the feeds that were broken as well. I see no way to add the 'own blog' entry any other way. It did not exist in Drupal 5 as far as I can see; so I don't consider it a big loss :-)

Also fixed one notice as bonus.

chx’s picture

chx commented
Status: Needs review » Closed (duplicate)

http://drupal.org/node/179519