Hi,

I'm trying to build a view block that shows some content related to the nid passed through an argument without allowing the user to actually view that whole node. However, when in the validation setting of the nid argument I uncheck "Validate user has access to the node", it seems that CA still does that validation and so no content appears.. I tried uninstalling CA and that solved the problem, so it's definitely something caused by this module.

PS. Think of this as showing some teasers in a block without giving an anonymous user the permission to actually see everything - that was the initial design of having the "Validate user has access to the node" checkbox and in my opinion it should not be overwritten by CA, more like integrated.

I would be very thankful for any kind of comments.

Thanks,
Martin

Comments

arski’s picture

arski commented

*bump* :( any thoughts anyone? Thanks!

arski’s picture

arski commented
Version: 6.x-1.2 » 6.x-1.x-dev

just tested with latest Views and the CA dev branch - same outcome.

arski’s picture

arski commented
Status: Active » Closed (works as designed)

Bleh, having gone through a pile of views code, it seems that the issue is with the db_rewrite_sql call in the node.module of Drupal, that adds some node access sql code to the query that gets then executed by views.. So apparently CA is only indirectly at fault there, the main culprit seems to be Drupal itself, and views a little.. seeing that there is no hook around there to modify anything, I don't see any way around this issue but to avoid using views and/or ca..

so nevermind.. :(

would have appreciated a response though.

dynamicdan’s picture

dynamicdan commented
Title: Views 'Validate user has access to the node' ignored because of CA » Content access module is incorrectly interfering with views
Version: 6.x-1.x-dev » 7.x-1.x-dev
Priority: Normal » Major
Status: Closed (works as designed) » Active

So after much debugging I have also found the same problem. When debugging views queries it is evident that the content access module has a sub query being executed in the view. Possibly as arski suggested through some kind of internal drupal 'has permissions' function.

My query as admin:

SELECT node.nid AS nid, node.created AS node_created, 'node' AS field_data_field_profile_firstname_node_entity_type, 'node' AS field_data_field_profile_birthdate_node_entity_type, 'fp_about_me:page' AS view_name
FROM 
{node} node
WHERE (( (node.uid = '792' ) )AND(( (node.type IN  ('profile')) )))
ORDER BY node_created DESC
LIMIT 1 OFFSET 0

My query as a non-admin

SELECT node.nid AS nid, node.created AS node_created, 'node' AS field_data_field_profile_firstname_node_entity_type, 'node' AS field_data_field_profile_birthdate_node_entity_type, 'fp_about_me:page' AS view_name
FROM 
{node} node
WHERE (( (node.uid = '792' ) )AND(( (node.type IN  ('profile')) )))AND ( EXISTS  (SELECT na.nid AS nid
FROM 
{node_access} na
WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '792') AND (na.realm = 'content_access_author') )OR( (na.gid = '2') AND (na.realm = 'content_access_rid') )OR( (na.gid = '4') AND (na.realm = 'content_access_rid') )OR( (na.gid = '8') AND (na.realm = 'content_access_rid') ))AND (na.grant_view >= '1') AND (node.nid = na.nid) )) 
ORDER BY node_created DESC
LIMIT 1 OFFSET 0

It's the sub query that is causing problems. I'm not convinced the query A) works how it should and B) should exist with views given the other views based permission restrictions.
Side note: turning on the drupal setting 'view own unpublished content' did not affect the query as it should have.

Looking into the code I can't set an easy solution except to somehow kill some hooks. A setting for 'enable/disable with views' might solve things for now.

Upping to major given the various open issues to do with views and this sub query thing being a most probably major component of problems (http://drupal.org/node/1213148, http://drupal.org/node/239139).

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Issue summary: View changes
Priority: Major » Normal
Status: Active » Closed (outdated)

This issue has not received any updates in the previous 9 years. If you believe it to still be relevant, you are encouraged to reopen the issue and update it.

If you got an email about this Issue status update, it is because you at one time (possibly a very long time ago), subscribed to it. To learn how to unsubscribe yourself, please visit: https://www.drupal.org/project/webmasters/issues/3142987