I noticed that sidecontent ignores the node_access of normal drupal nodes.

My fix is to insert the following code:

//does current user have view access on parent node?
if (!node_access('view',node_load(arg(1)) )) break;

this is placed right after:

// does user have  access to view node?
if (!user_access('access side content') && !user_access('create side content')) break;

See attachment for a patch.

CommentFileSizeAuthor
#3 sidecontent.module_0.patch2.33 KBstratofarmer
sidecontent.module.patch293 bytesstratofarmer

Comments

robert castelo’s picture

robert castelo commented

Does Sidecontent currently stop taxonomy_access from working on a node?

stratofarmer’s picture

stratofarmer commented

Sorry for not being that clear.

Without this patch, sidecontent will always show; even if taxonomy rules for user role do not allow viewing the parent node (page/story/whatever).

stratofarmer’s picture

stratofarmer commented
StatusFileSize
new sidecontent.module_0.patch2.33 KB

The patch in my startig post seems broken.

An improved one is attached.

stratofarmer’s picture

stratofarmer commented

This line is dirty:

if (!node_access('view',node_load(arg(1)) )) break;

Needs to become this:

if (!node_access( 'view',node_load(array('nid' => arg(1))) )) break;
robert castelo’s picture

robert castelo commented
Status: Needs review » Fixed

Access controls should now be working, please try again. If you find a problem re-open this issue.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)