Steps to reproduce:
1. Create a clean install of the drupalorg_testing profile.
2. Install the simple access module (DRUPAL-5 branch).
3. At admin/settings/simple_access, select the View check box and save.
4. At admin/user/simple_access, create a group called "Restrict projects". Check all roles except anonymous and authenticated.
5. Edit project/cvslog (or any other project). In the Access fieldset, check the View box next to Restrict projects.
6. Switch to a regular authenticated user (auth1 for example).
7. Go to node/add/project-issue/drupal and select a valid component, category, and fill in the require fields.
8. Click submit.

A whole host of PHP errors will pop up and the page will not load.
The root of this problem is in issue.inc in the project_issue_load() function. With simple access configured as I described above, and when you are a regular authenticated user, the line

$project = db_fetch_object(db_query(db_rewrite_sql('SELECT pi.* FROM {project_issues} pi WHERE pi.nid = %d', 'pi'), $node->nid));

returns NULL, and things go downhill from there. I don't think the problem lies in project_database_rewrite_sql(), because the same problem happens even if I comment out that entire function.

If anyone is more familiar with node access modules than I am, this would probably be fairly simple to diagnose. I'm not sure what is supposed to happen where with node access control, and I've already spent more time on debugging this than I care to.

Comments

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

db_rewrite_sql() here creates a JOIN against {node_access} which checks for Simple Access rules and returns no matches, blowing up the expected return.

As mentioned via email, this is a complex issue.

Node Access is a nasty beast -- Moshe and I are presenting on that in Szeged -- and the problem is that hook_access() doesn't really play nice with the Node Access system.

What we need to decide is whether to support an internal access system (hook_access and db_rewrite_sql) or the external Node Access system, warts and all.

Personally, I am more comfortable using a Project-specific access control scheme than trying to graft external schemes onto the system. But I suppoose that ideally, we can support both.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

We could make the project-based scheme configurable, so that some users could disable it and use the access control module(s) of their choice.

dww’s picture

dww
we/he/they
commented
Status: Active » Closed (duplicate)

I think the real solution here is to stop trying to play the part of a node access module: #234463: Remove 'access * project *' permissions