I have committed a handler for node access to Solr Views. Now a user can configure it to be all posts a user has access too. Soon I will be updated it have an option for only public posts. Which i think is an important function.

This patch removes the node access stuff from being applied to solr views queries.

CommentFileSizeAuthor
#1 access.patch1004 bytesScott Reynolds
access.patch1.64 KBScott Reynolds

Comments

Scott Reynolds’s picture

StatusFileSize
new1004 bytes

doh! apparently i had a conflict in the schema file :-D. so we will try this again

robertdouglass’s picture

I guess we can start out making exceptions this way. Later, if the landscape gets too crowded and too many special cases are being made we need to abstract, but that seems like too much work for this one case. The plugin sounds very interesting. Look forward to testing it.

Scott Reynolds’s picture

I think if i gets to that point, we start looking to build a tags/metadata system like what we see in D7 dynamic select queries.

robertdouglass’s picture

Status: Needs review » Patch (to be ported)

Committed to 6.2. Alone for adding the $caller param it is worth it.

Peter, do you want to apply to 6.1?

pwolanin’s picture

Version: 6.x-1.x-dev » 6.x-2.x-dev
Status: Patch (to be ported) » Needs work

This should really be a setting - so it should be a variable_get() of an array of module names to omit node access

pwolanin’s picture

Per discussion today - seems wrong that the Views integration module needs this at all - why would it not rely on Solr to do the filtering?

Scott Reynolds’s picture

Simple, I want it configurable. So lets say the following.

I want only those nodes that are node_access 0. Meaning all public posts. You don't want the url to solr to have all the node access stuff like (node_access:dalfjd:14 || node_addess:djakldaklfd:60) and then add in node_access:all:0.

Wasted stuff in the url.

What if I only want things that match a node access record for a subdomain? What if Im not on that subdomain currently?

What if I want to say give me all the nodes in this group that are public. EVEN if I am a member of the private group.

It is a pet peeve of mine, that all SQL queries for nodes have ALL the node access stuff applied. What if thats not what I want? I want to be able to say exactly which node access rules I want applied through an interface, per query. It is a user experience fail. But Im digressing.

pwolanin’s picture

@Scott - sounds more like a developer experience, rather than user experience issue.

Scott Reynolds’s picture

? really?

A user creates a private post and then searches for that post. And then they see it there. And they say
"Hey I thought this was private"

pwolanin’s picture

@Scott - how is that different than the same user seeing their post in a list of content.

I strongly disagree with breaking out of the standard nodeaccess framework - this is basically jsut asking for regular access bypass problems.

Scott Reynolds’s picture

So because Core has a major usability fail we should just keep it standard? How many users do you know that understand this?

Regardless, I will change the handler. Just disappointing...

jpmckinney’s picture

Status: Needs work » Closed (won't fix)

Having nodeaccess integration that allows modules to bypass it is asking for trouble. Re-open with better proposal if still needed.

franz’s picture

Status: Closed (won't fix) » Active

Oh wait.

There was a bypass committed regarding this issue: http://drupalcode.org/project/apachesolr.git/commit/eb8fc046c2191dd28990...

Look. It is NOT expected that restricted nodes show up in search results (using apachesolr_views) unless you manually restrict them. During the time it takes for someone to notice this, there will be private content exposed. Please make a regression of that commit ASAP.

pwolanin’s picture

Status: Active » Fixed

reverted that commit.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.