By jmlavarenne on

I use the following code found in John VanDyk's Pro Drupal Development :

$sql = "SELECT * FROM {node} WHERE type = '$type' AND status = 1 ORDER BY created";
$result = db_query_range(db_rewrite_sql($sql), 0, $nbDisplay);


while ($data = db_fetch_object($result)) {
  $node = node_load($data->nid);
 
  print node_view($node, TRUE);
  
}

All users, authenticated or not, have "access content" privilege. Other content shows up fine.

But all content produced by the above code is visible only to users with admin role.

I've been turning permissions on and off but can't nail the problem.

Any clue as to the cause?

Comments

gpk’s picture

gpk commented

As far as I recall, node_view() does not check access permissions - node_access() does that.

If ordinary users can't access the content produced by your code then, depending how you've implemented it, it's probably a permissions problem with the page it is embedded in or the relevant menu item in your module.

gpk
----
www.alexoria.co.uk

gpk
----
www.alexoria.co.uk

jmlavarenne’s picture

jmlavarenne commented

Thank you for the reply.

I don't think the page assesses permission. Other content on the page is visible for all roles.

The content called by node_view() in this case is not associated with any menu item, or any taxonomy term. They are just plain old node types that I want to display on the page. It's not even in a module - just a bit of loose script.

jmlavarenne’s picture

jmlavarenne commented

Also, the nodes which are not visible to non-admin users on the page are visible to all users if accessed directly in the browser address bar by node number, (/?q=node/129 for example).

gpk’s picture

gpk commented

Why are you using db_rewrite_sql()? I'm not saying it's wrong, I'm just asking, 'cos I've no idea what it does.

Also what is $nbDisplay?

gpk
----
www.alexoria.co.uk

gpk
----
www.alexoria.co.uk

jmlavarenne’s picture

jmlavarenne commented

$nbDisplay is just a variable that contains an integer, indicating to db_query_range() how many results are to be returned. It's just to make it easier for my client to control what is printed on the page.

I'm just using db_rewrite_sql() because it is part of the code I copied. It is described here in the api http://api.drupal.org/api/function/db_rewrite_sql/5

I did not read the bit about this function yet, but the headline of the section in the book is Exposing Queries to Other Modules with hook_db_rewrite_sql().

I'll take it out of the code and see if it changes anything.

jmlavarenne’s picture

jmlavarenne commented

By Jupiter! Removing the function made the nodes visible to all users.

Thank you for the big hint!

jmlavarenne’s picture

jmlavarenne commented

Actually, I started having access denied problems, so the issue might have been related to that. At this point it's all wild speculation - nothing scientific at all anymore about today's work. But it seems to be working good!

So I followed the instructions here :

http://drupal.org/node/134505

TRUNCATE node_access;

INSERT INTO node_access (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (0, 0, 'all', 1, 0, 0);
gpk’s picture

gpk commented

If you have (or have had) any access control modules installed, then you can go to admin -> content management -> post settings and hit the Rebuild permissions button. I'm using the TAC_lite module (5.x-1.x-dev), which does not seen to clean up after itself when disabled or re-enabled. If no access control modules are enabled then Rebuild permissions does the same as the code you have posted, except that having rebuilt the permissions, the option is not available again until such time as an access control module is enabled.

You may now wish to re-enable the db_rewrite_sql() function so that unpublished posts or posts in moderation don't make it into your list summary ... Probably worth looking at the output of the function so you can see what it is doing.

Alternatively the Views module may well be able to do what you are after, and more ...

gpk
----
www.alexoria.co.uk

gpk
----
www.alexoria.co.uk

jmlavarenne’s picture

jmlavarenne commented

Thanks a lot! Very useful post from which I gained a lot of insight. I had some such modules installed which I subsequently removed without knowing anything about Rebuild permissions.

I'll make myself read the views documentation. I was saving it for some spare time which ends up never existing.

gpk’s picture

gpk commented

>read the views documentation

Just install it in a sandbox and have a play... Simple listings of nodes are quite simple to set up ...

gpk
----
www.alexoria.co.uk

gpk
----
www.alexoria.co.uk