? 000-seven-form-css-sanity.patch
? 823428-url-entity.patch
? 920614-node-access-tests.patch
? 934790-theme-node.patch
? 963656-Improve-documentation.patch
? 963656-followup.patch
? 963656-node-access-doc.patch
? 963656-node_access_view_all_nodes-with-new-unit-test.patch
? 963656-view-all-nodes.patch
? 965514-bad-test.patch
? ajax_second_call_939860_06.patch
? file_download_access6.patch
? test.patch
? modules/node/tests/node_access_view_all.module
? sites/default/files
? sites/default/private
Index: modules/node/node.api.php
===================================================================
RCS file: /cvs/drupal/drupal/modules/node/node.api.php,v
retrieving revision 1.81
diff -u -p -r1.81 node.api.php
--- modules/node/node.api.php	5 Nov 2010 19:58:14 -0000	1.81
+++ modules/node/node.api.php	14 Nov 2010 16:28:25 -0000
@@ -143,6 +143,43 @@
  * module's responsibility to provide appropriate realms to limit access to
  * unpublished content.
  *
+ * Node access records are stored in the {node_access} table and define which
+ * grants are required to access a node.  An entry in the {node_access} table
+ * with node ID 0 corresponds to a global grant for the view operation.  It
+ * has no effect for other other operations like edit and delete.  If no node
+ * access modules are present, the core node module provides this global view
+ * permission for grant ID 0 and realm 'all'.
+ *
+ * Node access modules can replicate this behavior by providing their own
+ * conditional grant for an entry of {node_access} corresponding to node ID 0.
+ * For example, a module could create a record in {node_access} with:
+ * @code
+ * $record = array(
+ *   'nid' => 0,
+ *   'gid' => 888,
+ *   'realm' => 'example_realm',
+ *   'grant_view' => 1,
+ *   'grant_update' => 0,
+ *   'grant_delete' => 0,
+ * );
+ * drupal_write_record('node_access', $record);
+ * @endcode
+ * To grant global view access, the module may now returning the following array
+ * in response to hook_node_grants():
+ * @code
+ * if ($op == 'view') {
+ *   $grants['example_realm'] = array(888);
+ * }
+ * @endcode
+ *
+ * Beware that node_access_rebuild() function will erase any node ID 0 entry
+ * when it is called, as there is currently no hook to generate node ID 0
+ * grants.  Module developers are responsible for ensuring these gloabl view
+ * grants are restored after node_access_rebuild() is called.
+ *
+ * @see node_access_view_all_nodes()
+ * @see node_access_rebuild()
+ *
  * @param $account
  *   The user object whose grants are requested.
  * @param $op
Index: modules/node/node.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/node/node.module,v
retrieving revision 1.1317
diff -u -p -r1.1317 node.module
--- modules/node/node.module	9 Nov 2010 08:36:38 -0000	1.1317
+++ modules/node/node.module	14 Nov 2010 16:28:29 -0000
@@ -3008,15 +3008,12 @@ function node_access_grants($op, $accoun
  * Determines whether the user has a global viewing grant for all nodes.
  *
  * Checks to see whether any module grants 'view' for nid = 0. The node module
- * provides this record if no node access modules are enabled. Other modules
- * can replicate this behavior by providing their own conditional grant for
- * nid = 0. For example, hook_node_grants() can return the following array to
- * give the 'view' privilege to all nodes:
- * @code
- * if ($op == 'view') {
- *   $grants['example_realm'] = array(0);
- * }
- * @endcode
+ * provides this record if no node access modules are enabled.
+ *
+ * Note that this function does not allow a user to view all nodes. Instead, it
+ * removes the default JOIN from the {node} to the {node_access} table
+ * provided by node_query_node_access_alter() when querying for lists of nodes.
+ * Other rules enforced by the node_access() function are still applied.
  *
  * @return
  *   TRUE if 'view' access to all nodes is granted, FALSE otherwise.