Posted by ajayg on January 5, 2009 at 5:33am
Jump to:
| Project: | Relevant Content |
| Version: | 5.x-1.3 |
| Component: | Code |
| Category: | bug report |
| Priority: | critical |
| Assigned: | Unassigned |
| Status: | needs review |
Issue Summary
It seems the module does not obey any node_access restrictions. For example if you have a private organic group, the links to the content inside are available only to designated users. Other modules like tracker,views follow this convention. But relavant module shows links even if the reader does not have access to view actually content.
I think this is a critical access restriction that module should not ignore.
Comments
#1
perhaps this is duplicate (not sure though) since similar issue has been raised for domain acess module and RC.
#2
this may be duplicate of #344310: RC doesn't respect node access?.
#3
made following change to 5.x version of the module and now it seems to respect node access.
Search for following line in the function relevant_content_get_nodes.
$result = db_query($sql, $values);and change to
$result = db_query(db_rewrite_sql($sql), $values);I tested this with 5.x version with OG node acess enabled.
#4
Just so you are aware making the query node access aware is quite costly. The original query roughly takes 2.5 milliseconds. The modified query which respects node access took a whopping 219 milliseconds, almost 100 times more.