Not yet moderated node found in atom feed! (modr8 or atom issue?)

I don't use modr8, but a quick grep of the code appears to show that it doesn't use hook_node_grants(), which is how atom would know to not show the node.

This module does not provide access control - it uses db_rewrite_sql to exclude moderated nodes from (most) listings.

This would suggest the bug is in the Atom module - e.g. that it's not correctly calling db_rewrite_sql()

This is a security issue. Reporting to security team...

Yep db_rewrite_sql is only applied for taxonomy, not for anything else:

/**
 * Produces an atom 1.0 feed for the front page content.
 */
function atom_feed() {
  ...
  $nodes = db_query_range("SELECT n.nid FROM {node} n WHERE n.promote = '1' AND n.status = '1' ORDER BY n.created DESC", 0, variable_get('atom_feed_entries', 15));

  ...
}

function atom_blog_feed() {
  ...
  $nodes = db_query_range("SELECT n.nid FROM {node} n WHERE n.type = 'blog' AND n.status = '1' ORDER BY n.created DESC", 0, variable_get('atom_feed_entries', 15));

  ...
}

function atom_node_feed($nid) {
  ...
  $nodes = db_query_range("SELECT n.nid FROM {node} n WHERE n.nid = %d AND n.status = '1' ORDER BY n.created DESC", $nid, 0, 1);

  ...
}

function atom_user_blog_feed($uid) {
  ...

  $nodes = db_query_range("SELECT n.nid FROM {node} n WHERE n.type = 'blog' AND n.uid = %d AND n.status = '1' ORDER BY n.created DESC", $uid, 0, variable_get('atom_feed_entries', 15));
  ...
}

It is interesting to note that the results of the queries are run through node_load() and then checked through node_access('view', $node) so it's not like it didn't try. I'm wondering why this wouldn't catch nodes restricted with modr8 because sometimes I use the same logic with one of my modules.

function _atom_print_feed($nodes, $feed_info) {
  $output = '';
  $last_mod = 0;
  while ($node = db_fetch_object($nodes)) {
    $item = node_load(array('nid' => $node->nid));
    if (!node_access('view', $item)) {
      continue;
    }
  ...
}

Republishing this issue because the module does run all the proper access checks. Although it should be using db_rewrite_sql() on all those queries.

Note modr8 is not a node access module - it just hides nodes from listings using SQL rewrites.

The technique used by this module is adding the overhead of a lot of extra queries also - it should just let node access, etc, work via rewriting the queries like core does:

http://api.drupal.org/api/function/node_feed/6

Patch attached for review.

Changing title to be more appropriate

I know there's lots of discussion here, but it originated at #61791: Not Respecting Node Access, so I'd prefer to move there so all the other subscribers can follow the change.