Hi. For starters: love the ACL module. Trying to fully understand each line of it and its implications.
Problem:
My ACL implementation *does* write the correct records to the ACL tables, but they are totally ignored: anonymous users can access nodes that are supposed to be restricted.
Steps taken to troubleshoot:
- check module weights
- check if my module is enabled
- enable devel and devel node_access
- disable other modules that mess with node access (content_access, taxonomy access control). Exception: disabling OG was not an option because testing would no longer be possible.
Findings:
- devel node_access does not show any records with realm = acl
- stepping through the code with a debugger showed, in the end, that the following condition within acl_node_access_records() was always NULL:
if (module_exists($grant['module']) && module_invoke($grant['module'], 'enabled'))
More specifically,
module_invoke($grant['module'], 'enabled')
always returns NULL.
If I understand correctly, this iImplementation of hook_node_access_grants() should return a list of grant_ids (ACL calls these acl_ids) which will be taken into account by the node module when figuring out who has access.
Now, the conditions
if (module_exists($grant['module']) && module_invoke($grant['module'], 'enabled'))
ensure that
1. the module that created the ACL entries (let's call it foo.module) does in fact exist
2. calling foo_enabled() returns TRUE
This last part is what caused me a whole lot of trouble. I don't understand why ACL assumes any module that implements ACL will have a _enabled() function. I thought there might be a typo and that it should be 'enable' but that would cause the code to actually enable the module if it was previously disabled (I guess, right?), so no typo either.
When I remove that second condition, my entire ACL implementation works like a charm.
Long story short: I didn't know why a certain condition was there, couldn't deduct the rationale, removed it, and everything works. Please comment.
Assuming I was correct, I've added my change as a patch. This is my very first patch, please let me know if the format etc is ok.
Thx, and sorry for this lengthy piece, but I wanted to make myself really clear.
| Comment | File | Size | Author |
|---|---|---|---|
| acl_jpoesen_1.patch | 621 bytes | jpoesen |
Comments
Comment #1
salvisI missed the context here. What exactly are you trying to do? Reimplement ACL? Then replace every instance of the letters "acl" with "myacl" or whatever — module name, function names, database table names, realm, everywhere. Then it will work.
Do you mean use ACL? Look at Forum Access for an example of a module that uses ACL. The _enabled() function is required for proper behavior when a node access module is disabled, and yes, ACL needs it, too.
Comment #2
jpoesen commentedSorry, let me clarify. I have a module that uses ACL to control node access to certain nodes under certain conditions. I'm not trying to reimplement ACL.
Ok, I took a look at Forum Access. I realize now that my module needs to implement hook_enable, hook_disable, _disabling() and _disabled().
In fact all modules that want to use ACL need to implement this, correct? Is this documented somewhere? I'm in the process of writing up a detailed tutorial on the usage of ACL - I'd love any tutorial or guide you you can point me to. There don't seem to be too many around.
Thanks for pointing me in the right direction.
Comment #3
jpoesen commentedI guess this can be closed now.
Comment #4
salvisOk, glad to help!
The _disabling stuff is explained at http://api.drupal.org/api/file/developer/examples/node_access_example.mo.... It's needed for proper cooperation with the node access infrastructure in core, and ACL piggy-backs on it.
Indeed, I'm not aware of any... :-(
I'd be very interested in reviewing your tutorial, possibly including it in the ACL package (with proper acknowledgement, of course) or having it posted on d.o.
Comment #5
jpoesen commentedGreat. I have an outline and some draft paragraphs now. As soon as the whole is somewhat coherent, I'll pass it along.
Thanks
Joeri