Hello,

when a user searches for two terms (implicit AND), there are more results shown, than relevant. This only happens when Forum Access is activated (but the additional results are not from restricted forum, they are just not relevant)

Structure of forum:
Forum 1 (not restricted, also open for guest)
Forum 2 (not restricted)
Forum 3 (restricted to usergroup A)

When a guest searches for "a b", the correct search result is given. (one result with both a and b on page)

If a member of usergroup A searches for "a b", he gets correct search result + irrelevant search results from Forum 1!!! (where only "a" is present).

So this is not a problem with wrong set access rules, but with a wrong generated search query ( i guess).

At site.com/en/admin/content/node-type/forum/access I deactivated all checks - access rules are managed at each forum.

Please tell me, whether your need further information. I really hope you can help me. This bugs me for quite a time, but I cannot fix it myself.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

salvis’s picture

Status: Active » Postponed (maintainer needs more info)

Forum Access lives in admin/content/forum/edit/forum/% — the path that you give does not belong to FA.

Install the Devel module and activate query logging. Then look for the "wrong query."

balabushka’s picture

Hello Salvis,

thank you for the quick reply.

I know where to configure Forum Access, I just wanted to tell you, that I followed the instructions shown on http://www.site/en/admin/content/forum/edit/forum/%, which otherwise could be a reason for errors.

*********************************************************************************************************
Content Access
You have set the Content Access module to control access to content of type Forum topic—this can interfere with proper operation of Forum Access! Specifically, any grants given by Content Access cannot be taken back by Forum Access.
Unless you really know what you're doing, we recommend that you go to the Content Access configuration for the Forum topic type page and clear all checkboxes. This will instruct Content Access to leave the Forum topic nodes alone. However, if you put nodes of other content types into forums as well, then these content types will continue to have this problem.
Alternatively, you can give Forum Access priority over Content Access by either raising the priority of Forum Access in every forum above the priority of Content Access, or by lowering the priority of Content Access for the content types in question below the priority of Forum Access.
***********************************************************************************************************

I hope, the pager_query was the query you wanted - I attached the pager query for the 3 cases (anon => correct result, user => wrong result, admin => correct result).

The correct result is 1 search result, the wrong behaviour shows 9.

Wrong result:
type sid score
node 1136 8.7204873522364
node 1151 4.3577104190033
node 1100 3.5581337310164
node 336 3.1788652931697
node 1117 2.7854848205002
node 356 2.404370249703
node 653 1.966637360426
node 523 0.80628807314983
node 334 0.27835506160043

Correct result:
type sid score
node 1136 8.7204873522364

Thank you for looking into this problem!

balabushka’s picture

Both pager_query_admin_correct files are correct - just one is for english results, one for german.

salvis’s picture

Here's what we have (pager_query_user_wrong.txt):

SELECT i.type, i.sid, 
  5 * (5.3625104165763 * SUM(i.score * t.count)) + 5 * POW(2, (GREATEST(MAX(n.created), MAX(n.changed), COALESCE(MAX(c.last_comment_timestamp), 0)) - 1353051499) * 6.43e-8) + 5 * (2.0 - 2.0 / (1.0 + MAX(c.comment_count) * 0.04)) AS score 
FROM search_index i 
INNER JOIN search_total t ON i.word = t.word 
INNER JOIN node n ON n.nid = i.sid 
INNER JOIN node_access na ON na.nid = n.nid 
LEFT JOIN node_comment_statistics c ON c.nid = i.sid 
WHERE n.status = 1 
AND (na.grant_view >= 1 
  AND ((na.gid = 0 AND na.realm = 'all') 
    OR (na.gid = 6 AND na.realm = 'content_access_author') 
    OR (na.gid = 2 AND na.realm = 'content_access_rid') 
    OR (na.gid = 8 AND na.realm = 'content_access_rid') 
    OR (na.gid = 2 AND na.realm = 'forum_access') 
    OR (na.gid = 8 AND na.realm = 'forum_access'))) 
AND (n.language ='de' OR n.language ='' OR n.language IS NULL) 
AND (i.word = 'iso' OR i.word = 'japan') 
AND i.type = 'node' 
GROUP BY i.type, i.sid HAVING COUNT(*) >= 2 
ORDER BY score DESC 
LIMIT 0, 10

Node access adds the INNER JOIN node_access na ON na.nid = n.nid and the AND (na.grant_view >= 1 ... ))) condition. These are not present for 'administer content' roles.

The culprit is GROUP BY i.type, i.sid HAVING COUNT(*) >= 2. Your search condition is AND (i.word = 'iso' OR i.word = 'japan'), and the OR is turned into an AND by requiring at least two matching records. However, the variants introduced by Node Access cause the counts to be >=2 even if only one of the search words matches.

This is not a Forum Access issue. You could just as well have titled "Search does not work correctly with Content Access activated", because this is completely symmetrical between FA and CA. Actually, I think that, for a user that has roles 2 and 8, you'll get the same issue with only one of the two NA modules.

This is an issue between Core Search and Core Node Access. I don't think the NA modules can do anything about it.

balabushka’s picture

Hello salvis,

thank you very much for your detailed answer.

What are your suggestions on how to handle this issue? Can you move the thread to the appropriate area? Do you think the issue will be solved in version 7 of Drupal?

Actually I am not capable of fixing this issue myself.

Thank you for your assistance!
Balabushka

salvis’s picture

Title: Search does not work correctly with Forum Access activated » Searching for multiple words does not work correctly in the presence of a node access module
Project: Forum Access » Drupal core
Version: 6.x-1.8 » 6.x-dev
Component: Code » search.module
Status: Postponed (maintainer needs more info) » Active

The expected behavior when searching for multiple words is to get results only if all words match. This is implemented by counting the matching rows and eliminating the nodes where the number of rows is not at least as big as the number of words in the search.

Unfortunately, node access can introduce additional duplicates, so that the required number is reached even with a partial match.

I don't know whether this issue is present in D7 and D8.

@balabushka: Please try this out in D7. BTW, what version of D6 core are you using?

jhodgdon’s picture

Version: 6.x-dev » 8.x-dev
Priority: Normal » Major
Issue summary: View changes
Issue tags: +Needs manual testing, +Needs backport to D7, +Needs backport to D6

Looking through some old issues... We need to test this but I bet it is present in both drupal 7 and 8, because the search queries and node access have not changed significantly since 6.

I also think this is a fairly major issue, if you cannot search with a node access module turned on.

Nick_vh’s picture

Steps to reproduce

1) Install Drupal with Standard profile
2) Create content for Article and Content for Pages with the words dog and cat
3) Make sure anonymous has access to search + advanced search but has NO access to view published content.
3) Find NodeSearch.php and replace the following (hacky but does the trick)

  public function access($operation = 'view', AccountInterface $account = NULL) {
    return !empty($account) && $account->hasPermission('access content');
    return true;
  }

with

public function access($operation = 'view', AccountInterface $account = NULL) {
    return true;
  }

4) Search for dog as anonymous. You should be able to see a result.
5) Click on the content, you should NOT be able to see the node as you don't have permission to do so.
6) Fixing it and find a better way to reproduce.

jhodgdon’s picture

There is a test module for testing node access that I think you can turn on with Drush, so that might make for an easier way to reproduce this? It should be under the node module somewhere.

jhodgdon’s picture

Actually, the reproduce in #8 would be for a different issue and I'm not sure it's totally valid anyway.... The issue here is that if you do an AND search (multiple words means AND) and you have a node access module turned on, it doesn't work correctly due to the way the search query extender decides if all the necessary words have been matched.

For this issue, there's a test module called node_access_test under core/modules/node/test, and a test case called NodeAccessBaseTableTest that uses it to create a bunch of nodes and verify that they can/can't be seen by appropriate users.

It seems like we could basically take the parts of that test that set up node access in setUp() and create nodes in testNodeAccessBasic(), and then search for "node created" (both words should be in all of the nodes that are created, either in the title or the body).

jhodgdon’s picture

Status: Active » Needs review
FileSize
3.71 KB

I just created a test for this for Drupal 8. The test passes locally. So I do not believe this is still a problem in Drupal 8. (note: the site I tried this on has the patch for #1366020: Overhaul SearchQuery; make search redirects use GET query params for keywords installed, so let's see if the test bot agrees that this test passes in current Core as well).

Given that this test passes, I think this is not an issue for Drupal 8. But given that it has in the past been an issue, I think we should add this test to the Drupal 8 code base, and then move this issue to Drupal 7 and see if we can resolve it there.

jhodgdon’s picture

Assigned: Unassigned » jhodgdon
ianthomas_uk’s picture

Status: Needs review » Needs work

The test looks sensible to me, but it would be good to run it on Drupal 7 to prove that it catches the bug.

One nitpick: the $edit arrays should use $private_title and $public_title.

jhodgdon’s picture

Status: Needs work » Needs review
FileSize
3.71 KB
813 bytes

I actually do not know if the bug exists in 7 or not. It was reported in 6. I'm not up for porting this to 7 any time soon, as I'm focused on 8 and am not a maintainer of 7's search.module. If that is a dealbreaker for getting the test added to 8, let's just move this back to 7 and someone else can work on it there and see if the test works/ports/etc. (If we had actual contrib modules for 8 that used the node access system we could test manually in 8 but I don't know of any, which is why I wrote the test.)

Meanwhile, thanks for reviewing the patch and spotting that stupid error, which is fixed in this patch.

jhodgdon’s picture

I ported the test to Drupal 7 today. It passes there as well. Patch attached.

This issue was reported on Drupal 6 originally with the Forum Access module. I'm going to try to reproduce it in 7 with the same module. Will report back. My suspicion now is that this is a Drupal 6-only bug.

jhodgdon’s picture

Version: 8.x-dev » 6.30
Status: Needs review » Closed (cannot reproduce)

OK, I just installed 6 and 7 latest versions, and downloaded the latest version of forum_access as well.

On both sites, I did the following to test:

a) drush en forum_access (this also downloaded acl and in 7, also chain_menu_access, and enabled these as well as the core Forum module)

b) Went to admin/structure/forum (7) or admin/content/forum (6). It says the content permissions need to be rebuilt, so I rebuilt them.

c) Clicked "Add forum", and added forums:
forum1 - open to anonymous for viewing
forum2 - open only to authenticated for viewing

d) Added a post in both forums. Body is "test body words one" for node/1 in forum 1, and "test body words two" for node/2 in forum 2.

e) Verified from another browser that anonymous user can see node/1 but not node/2.

f) Turned on Search module (6; it is part of std profile in 7). Ran cron to index search. Granted anonymous users permission to search.

g) Verified that if an anonymous user searches for "test" or "test body" or "test body words" they see only node 1 (works in both). User 1 also gets the right search results.

h) I also tried searching for "test one" and test two". In all cases, anonymous and user 1 both get the right search results.

i) User 1 is special, so I created a new user and logged in as that user. I also could not find any problems when searching with this user for "test" "test one" "test two" or "test body".

So... I am just going to close this as "cannot reproduce".

If someone still thinks this is a bug, please reopen and provide steps to reproduce.