Project: Drupal Version: cvs Component: node.module Category: bug reports Priority: critical Assigned to: Anonymous Reported by: gordon Updated by: gordon Status: patch Ah, I actually thought that I saw the function node_node_grants(). I think we need to get this in asap, esp if people are using the node_priv_byrole module. gordon Previous comments: ------------------------------------------------------------------------ January 23, 2005 - 09:38 : gordon Attachment: http://drupal.org/files/issues/node_22.patch (1.24 KB) I have found that since the node_rewrite_sql() patch has been applied the node_access doesn't seem to be working. I have tracked it down to the node_access_join_sql() and node_access_where_sql in which it checks for the existance of the access_grants hook. This hook access_grants doesn't actually exist, and should really be the node_grants() hook. This is actually stopping the node_rewrite_sql() from working. Attached is a patch to correct this. ------------------------------------------------------------------------ January 23, 2005 - 11:13 : gordon Looking at this more, I beleive that this is critical because of the incorrect checking of the node_grants hook every user is able to see all nodes, but I have a feeling that they maybe able to see the teaser. ------------------------------------------------------------------------ January 23, 2005 - 20:22 : chx Attachment: http://drupal.org/files/issues/node_23.patch (1.22 KB) While you are right about the fact that I have made a bug here, the fix is also wrong. node_access_grants calls module_invoke_all('node_grants') so indeed module_implements('node_grants') is needed. module_implements('node_grants') will an array with the names of the modules which implement hook_node_grants. If there are none, it will return an empty array. The array('node') thing was required for access_grants, 'cos node_access_grants always exists. Not so with node_node_grants -- this never exists. Enough chit-chat, let's see the patch. -- View: http://drupal.org/node/16026 Edit: http://drupal.org/project/comments/add/16026