Hi,
I've got an issue with creating comments for a non administrator user.
In resources/comment_resource.inc, in the callback function _comment_resource_access(), where the operation is "create", it checks for the "post comments" permission, as well as making a call to _comment_resource_node_access() passing $comment->nid. This then calls _node_resource_access()
$comment is created from $args[0] (where $args is a parameter into _comment_resource_access()), but $args is empty, which means the call to _node_resource_access fails with a "Node id: could not be found" error.
Is this a bug, or is it something I am (not) doing?
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | services-6.x-comment-test.patch | 1.84 KB | kylebrowning |
| #7 | services-7.x-comment.patch | 672 bytes | kylebrowning |
| #3 | services-7.x-comment.patch | 522 bytes | kylebrowning |
| #1 | services-1045724.patch | 698 bytes | kylebrowning |
Comments
Comment #1
kylebrowning commentedNope, this is a bug, thanks!
here is a patch to fix this issue,
Comment #2
kylebrowning commentedComment #3
kylebrowning commentedHeres the 7.x patch as well
Comment #4
gddThe original post was saying that when submitting a comment $args[0] is empty, so no comment is loaded. I'm not sure how these patches address that issue. Also the removal of filter_access() in the D7 patch is a security issue. That needs to come back.
I'm actually not sure how it is possible that $args could come through empty since the argument is required. Tests are passing so I'm inclined to call this user error. polarbear128, can you post your original code?
Comment #5
kylebrowning commentedIf you look at the first patch in #1, youll notice that _comment_resource_node_access($comment->nid, COMMENT_NODE_READ_WRITE) is actually wrong.
Its passing an NID as the $op, and a constant as the args.
Something is clearly wrong there, when i tested this I was able to replicate, and this actually fixes those issues.
The filter access is wrong, and ill get that added back in for 7.x
Comment #6
kylebrowning commentedwoops
Comment #7
kylebrowning commentedSo, this is definitely broken in 7.x
Add this "files[] = tests/functional/ServicesResourceCommentTests.test" to your services.info and Add this text for 7.x
It doesnt work.
https://github.com/kylebrowning/services/commit/12da04968dc7a9c8a28f2734...
That will give you the resourceCommentTests.test file and add the services line.
You should see a HUGE big fat fail. :P
Heres the patch that fixes this FOR 7.x ONLY!
Ill bring the tests down to 6.x-3.x after this is acknowledged.
Comment #8
kylebrowning commentedThis attached patch will allow you to see the issue in 6.x.
As you can see, the privileged user has administer comments, so they never get to this place.
Comment #9
gddOK, I'm starting to get this now. We should probably start scrubbing the tests to make sure they are working with more appropriate privileges. Will take more time to look at this in a bit.
Comment #10
ygerasimov commentedTest for comment resource for d7 is not ready yet. I hope to finish it soon. Please wait for it and we will also need to add regression test for this issue.
Comment #11
ygerasimov commentedI have finished porting comments resource to d7 and tests. I have posted patch to #1065568: Comment Resource. Port to D7. Move to drupal_form_submit
Comment #12
kylebrowning commentedMarking this as closed because #1065568: Comment Resource. Port to D7. Move to drupal_form_submit takes care of this.