Hi,

What seems to happen :

In function _node_query_node_access_alter(), when it try to found a node table in joined tables (so it isn't the base table), it doesn't care about outer join. As a result, it will try to join a null nid on node access table which will exclude it...

What is expected :
- retrieve the row from outer join anyway rather than exclude a nid which doesn't exists...

How to reproduce it :
- First of all, have a least one grants node enable...
- execute the query with a user which doesn't have bypass access
- have a query to lists users which could have a reference on a node or not. So base table is "users". And we have an outer join on node table (left join for example).
- tag this query with "node_access". Query tag node access will set conditions without taking care of the outer join.

To conclude, it should be great that node access subquery is added to the query into a conditional "or" with a check on null nid field if join type is outer like :

db_or()->isNull("$nalias.$field")->exists($subquery);

In that way, if the row joined with node table is null, it won't "execute" subquery which will exclude it.

Here is a quick and simple patch which really needs work and improvement ! This is just a fully untested patch which do the tricks in my use case (describe above)...

thanks you

CommentFileSizeAuthor
#1 node-query_node_access-1850912-1.patch2.61 KBchaby
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

chaby’s picture

Status: Active » Needs work
FileSize
2.61 KB
TwoD’s picture

Component: node.module » ajax system
Issue summary: View changes
Related issues: +#1349080: node_access filters out accessible nodes when node is left joined

This seems to be related to #1349080: node_access filters out accessible nodes when node is left joined, which takes a different approach and by now has patches for both D8 and D7.

Version: 7.17 » 7.x-dev

Core issues are now filed against the dev versions where changes will be made. Document the specific release you are using in your issue comment. More information about choosing a version.