It seems the module does not obey any node_access restrictions. For example if you have a private organic group, the links to the content inside are available only to designated users. Other modules like tracker,views follow this convention. But relavant module shows links even if the reader does not have access to view actually content.

I think this is a critical access restriction that module should not ignore.

Comments

ajayg’s picture

ajayg commented

perhaps this is duplicate (not sure though) since similar issue has been raised for domain acess module and RC.

ajayg’s picture

ajayg commented
Status: Active » Closed (duplicate)

this may be duplicate of #344310: RC doesn't respect node access?.

ajayg’s picture

ajayg commented
Status: Closed (duplicate) » Needs review

made following change to 5.x version of the module and now it seems to respect node access.

Search for following line in the function relevant_content_get_nodes.

$result = db_query($sql, $values);

and change to

$result = db_query(db_rewrite_sql($sql), $values);

I tested this with 5.x version with OG node acess enabled.

ajayg’s picture

ajayg commented

Just so you are aware making the query node access aware is quite costly. The original query roughly takes 2.5 milliseconds. The modified query which respects node access took a whopping 219 milliseconds, almost 100 times more.