From 389ad9dc482bd114462763b8a1d98d4ada82869d Mon Sep 17 00:00:00 2001
From: Bradley M. Froehle <brad.froehle@gmail.com>
Date: Mon, 8 Nov 2010 10:28:12 -0800
Subject: [PATCH] 963656: node_access_view_all_nodes() is never invoked

---
 modules/node/node.module            |   10 ++++++++++
 modules/node/node.test              |   19 +++++++++++++++++++
 modules/node/tests/node_test.module |    9 +++++++++
 3 files changed, 38 insertions(+), 0 deletions(-)

diff --git modules/node/node.module modules/node/node.module
index 2097a91..75f3a13 100644
--- modules/node/node.module
+++ modules/node/node.module
@@ -3006,6 +3006,12 @@ function node_access_grants($op, $account = NULL) {
 
 /**
  * Determine whether the user has a global viewing grant for all nodes.
+ *
+ * By design, this function checks to see whether any module grants
+ * 'view' for node id 0. Node module provides this record if no node
+ * access modules are present. This function allows other modules to
+ * replicate this core behavior by providing their own conditional grant
+ * for nid 0.
  */
 function node_access_view_all_nodes() {
   $access = &drupal_static(__FUNCTION__);
@@ -3099,6 +3105,10 @@ function _node_query_node_access_alter($query, $base_table, $type) {
   if (!count(module_implements('node_grants'))) {
     return;
   }
+  // If viewing nodes, make sure access rules should be enforced.
+  if ($op == 'view' && node_access_view_all_nodes()) {
+    return;
+  }
 
   // Prevent duplicate records.
   $query->distinct();
diff --git modules/node/node.test modules/node/node.test
index 66d6bf7..d32b81e 100644
--- modules/node/node.test
+++ modules/node/node.test
@@ -917,6 +917,25 @@ class NodeAccessRecordsUnitTest extends DrupalWebTestCase {
     $node6 = $this->drupalCreateNode(array('status' => 0, 'disable_node_access' => TRUE));
     $records = db_query('SELECT realm, gid FROM {node_access} WHERE nid = :nid', array(':nid' => $node6->nid))->fetchAll();
     $this->assertEqual(count($records), 0, t('Returned no records for unpublished node.'));
+
+    // Check that node_access_view_all_nodes() allows node access modules
+    // to override their own access rules on the 'view' operation.
+    node_access_rebuild();
+    variable_set('node_test_node_access_all', 1);
+    drupal_static_reset('node_access_view_all_nodes');
+    $this->assertFalse(node_access_view_all_nodes(), t('Node access returned false for node_access_view_all_nodes().'));
+    $record = array(
+      'nid' => 0,
+      'gid' => 0,
+      'realm' => 'node_access_all',
+      'grant_view' => 1,
+      'grant_update' => 0,
+      'grant_delete' => 0,
+    );
+    drupal_write_record('node_access', $record);
+    drupal_static_reset('node_access_view_all_nodes');
+    $this->assertTrue(node_access_view_all_nodes(), t('Node access returned true for node_access_view_all_nodes().'));
+    variable_set('node_test_node_access_all', 0);
   }
 }
 
diff --git modules/node/tests/node_test.module modules/node/tests/node_test.module
index cfc503d..ad61375 100644
--- modules/node/tests/node_test.module
+++ modules/node/tests/node_test.module
@@ -38,6 +38,10 @@ function node_test_node_view($node, $view_mode) {
  * Implements hook_node_grants().
  */
 function node_test_node_grants($account, $op) {
+  // Test for node access override.
+  if ($op == 'view' && variable_get('node_test_node_access_all', 0)) {
+    return array('node_access_all' => array(0));
+  }
   // Give everyone full grants so we don't break other node tests.
   // Our node access tests asserts three realms of access.
   // See testGrantAlter().
@@ -101,6 +105,11 @@ function node_test_node_access_records_alter(&$grants, $node) {
  * Implements hook_node_grants_alter().
  */
 function node_test_node_grants_alter(&$grants, $account, $op) {
+  // Test for node access override.
+  if ($op == 'view' && variable_get('node_test_node_access_all', 0)) {
+    return;
+  }
+
   // Return an empty array of grants to prove that we can alter by reference.
   $grants = array();
 }
-- 
1.7.0.4