I have installed both this module & the nodeaccess module for Drupal 6. The FAQs do not honor the nodeaccess permissions. Specifically, I have two roles setup (partner & customer). I have three test FAQs: #1 is granted to Customer only; #2 is granted to Partner only; #3 is not Published yet.
When viewing FAQs through the normal FAQ UI, I only see the correct nodes. However, if I simply type in the URL for an FAQ (I'm using pathauto), I can see it. This includes the unPublished one.
I have all permissions REMOVED from Authenticated User & Anonymous user. (Only Customer & Partner have anything checked). Interestingly, if I log out, then I cannot see any of the FAQs if I try the URL (Access Denied).
So, it seems that the FAQ module may not correctly handle permissions correctly when accessing nodes directly by URL.
| Comment | File | Size | Author |
|---|---|---|---|
| #14 | faq_5x_309375.patch | 3.36 KB | stella |
| #14 | faq_6x_309375.patch | 3.33 KB | stella |
| #12 | faq_5x_309375.patch | 3.9 KB | stella |
| #12 | faq_6x_309375.patch | 3.87 KB | stella |
| #2 | faq_access.patch | 558 bytes | alexanderpas |
Comments
Comment #1
mrmelson commentedNOTE: Deleting faq_access from faq.module seems to have resolved this problem. By doing this, it allows nodeaccess to control who can see each faq. This allows FAQs to be targeted to roles & even individual users. It also resolves the bug of users being able to see unpublished faqs.
Comment #2
alexanderpas commentedComment #3
hutch commentedPerhaps this needs to be worked in using something like
So that it can work both ways.
The facility to regulate who gets what without the node_access module should be retained IMHO.
Comment #4
alexanderpas commentedno, that's not an option, as that breaks drupal's modular setup... also, what about the following modules, Taxonomy Access Control, Taxonomy Access Control Lite, Content Access or even future modules? do they also need a special case?
Comment #5
hutch commentedI was positing a solution to your particular problem and pointing out that it breaks the existing ability to control who sees what. The patch may work for you but I for one won't be using it for that reason. YMMV
Comment #6
stella commentedmrmelson: the unpublished node issue has already been reported and fixed in #277349: Unpublished FAQ node visible to everyone.
I will investigate the nodeaccess problem shortly. I'm not particularly fond of either of the two solutions posted above, but will look into it further.
Cheers,
Stella
Comment #7
alexanderpas commentedmy solution, is based upon looking to how other modules handle their stuff ;)
Comment #8
mrmelson commentedStella - Thanks for the pointer to the other bug. I applied the patch & it's working great now.
This is a great module - exactly what I needed.
(And, although I realize it's not a good fix for the module ... I'm actually very happy with the "hack" of deleting faq_access. nodeaccess+faq is proving to be a very powerful combination :)
Perhaps a solution might be a configuration checkbox that says "Skip FAQ Access Checking" with a note that says it is to be checked whenever access control is controlled by another module.
Comment #9
alexanderpas commentedin my opinion, that i not an option, as that will lead to usability problems, and is exactly the opposite as what is "encouraged" by drupal.
Removing the view clause, will make the faq content-type behave exactly the same as all other content types, which sould be expected.
Comment #10
nancydruActually, you probably just need to change the op=view code:
There are not many cases, other than op=create, where hook_access should be returning FALSE. I'm pretty sure you have all the appropriate db_rewrite_sql's.
Comment #11
alexanderpas commentedNancy, that doesn't work when you need access control based of for example the category (taxanomy) the faq is in.
remember, we shoudn't decide who's allowed to view the faq, the access modules should. (that's why they're there in the first place)
Comment #12
stella commentedAttached is a patch which should resolve the issue. The 'view faq' permission is now gone and has been replaced with 'view faq page' which controls which users have access to view the generated faq pages, and that's all. If site admins wish to control which users have access to faq nodes, or individual faqs, then one of the access modules should be used, e.g. nodeaccess, tac_lite, etc.
Cheers,
Stella
Comment #13
alexanderpas commentedcontains duplicate code, for example:
node_access() already specifies:
also disallowing access on unpublished status is already covered for in node_access(), by the final
return FALSE, this might also give problems with content moderation modules.Comment #14
stella commentedComment #15
alexanderpas commentedpatches are looking visually okay, however, i would like to see another review ;)
Comment #16
stella commentedCommitted.
Comment #18
stella commentedReleased in 5.x-2.12 and 6.x-1.8.