search_attachment and node access

Subscribing

I have installed node_access as well as search_files. I created a content type called PDF and generally granted all roles other than anonymous permission to search files. But I have posted specific pdf files that only organization leaders and administrators may view. The nodes are not visible to anyone else, but a low-level authorized user who searches files gets a list of attached files and can view those files.

This is an important security issue.

I would also appreciate this feature.

Tracking. Very important that it respect access control.

Should this be considered a security issue? (Private data is being made available publicly in the current version of the module.)

It's a security bug. Tracking it.

Subscribe

As a quick fix, I added a node_access check right after the node_load in search_files_attachments.module file.

        $node = node_load($file->nid);
        if (node_access("view", $node)) {
          $realpath = realpath($file->filepath);
          if (is_file($realpath)) {
            $fileinfo = (object)pathinfo($realpath);
            $results[] = array(
              'link' => file_create_url($file->filepath),
              'title' => $file->filename,
              'user' => theme('username', $node),
              'date' => $file->timestamp,
              'type' => check_plain(search_files_helper_name($fileinfo->extension)),
              'node' => $node,
              'score' => $item->score / $total,
              'extra' => array(l(t('Node'), "node/" . $node->nid)),
              'snippet' => search_excerpt($keys, $file->data),
            );
          }
        }

The pager doesn't work properly with this though. I would guess db_rewrite_sql should be used somehow with do_search.

subscribe

Please test the attached patch against the latest dev release.

This patch should also delete files from the search index if they have been removed from a node, or a node is deleted.

drenton, your patch in #13 seems to work very well for me. Like the OP, I am restricting access to certain nodes via the Taxonomy Access Control module and the search results now respect the privileges granted through the module.

I installed the dev version and applied the patch. The module appears to be working correctly now and respecting access permissions.

Thanks for the fix

Thanks for this. When will the patch be added to the Dev version officially?

Subscribing....

Just made a couple of changes from patch on comment 13.

- removed the private file system patch ( http://drupal.org/node/598136 ) from this patch
- change in hook_nodeapi to check if $node->files is an array or object

i tried and works, so i put to be ported :)

I have committed the patch in #18

thanks @jrglasgow to take care of us :)