Unprotected images (and presumably unprotected files) cause SQL errors when referenced in a node.

William Haller - June 6, 2008 - 14:56
Project:Protected node
Version:6.x-1.3
Component:Code
Category:bug report
Priority:normal
Assigned:Unassigned
Status:closed
Description

The site under development has been upgraded from 5.x to 6.2.

When unprotected images are displayed on pages, protected_node_file_download throws errors. It looks like uploaded files would also throw errors for the same reason.

For images, the error reported is unknown column f.nid in the query SELECT n.nid FROM files f, protected_nodes pn, node n WHERE pn.nid = f.nid AND f.nid = n.nid AND f.filename = 'images/WRAT.thumbnail.jpg'

Changing the code as follows prevents the error, but may be the wrong way to accomplish the purpose of the function and may not be portable for all types of uploaded files. I'm running private files, so I had to use a $path to match the image name.

$path = file_directory_path();
$db_file = db_result(db_query('SELECT i.nid FROM {files} f, {image} i, {protected_nodes} pn WHERE pn.nid = i.nid AND i.fid = f.fid AND f.filepath = \'%s/%s\'', $path, $file));

if(db_error() || $db_file === FALSE) {
$db_file = db_result(db_query('SELECT u.nid FROM {files} f, {upload} u, {protected_nodes} pn WHERE pn.nid = u.nid AND u.fid = f.fid AND f.filepath = \'%s/%s\'', $path, $file));
}

I'm pretty sure there weren't any issues for this in 5.x.

#1

mcarbone - August 21, 2008 - 23:29
Status:active» needs review

So my thought is that Protected Node doesn't promise to protect images within a node (not yet), but it does specify as a feature protecting file uploads. So I'm including a patch that fixes this bug for private file uploads. My suggestion is to add support for other file types (images, filefields, etc.) in a separate issue.

Another related problem I found is with caching when accessing a protected node's uploaded files with an anonymous user. So I added a page cache clear after a user access a protected node. This isn't perfect, but it works (unless another anonymous user tries to access the file in between the time you get to the protected node and click the file link). Ideally, Drupal would allow a way to exclude a pages entirely from its page_set_cache call.

AttachmentSize
protected_node_private_file.patch 1.12 KB

#2

tolmi - October 14, 2008 - 09:22
Status:needs review» fixed

Please see #233979 if the issue with caching still stands and reopen it if necessary.
Also I think this is fixed but I haven't closed this issue. Setting to fixed now.

--project followup subject--

Anonymous (not verified) - October 28, 2008 - 09:35

Automatically closed -- issue fixed for two weeks with no activity.

#3

Anonymous (not verified) - October 28, 2008 - 09:41
Status:fixed» closed

Automatically closed -- issue fixed for two weeks with no activity.

 
 

Drupal is a registered trademark of Dries Buytaert.