backdrop-issues icon indicating copy to clipboard operation
backdrop-issues copied to clipboard

Published 20 hours ago • verified publisher icon backdrop

node_access filters out accessible nodes when node is left joined

Open aitala opened this issue 11 months ago • 17 comments

Description of the bug

From https://www.drupal.org/project/drupal/issues/1349080 and https://www.drupal.org/node/3176634

Currently, when a node table is left joined into a query, adding a node_access tag to the query filters out accessible rows from the base table (effectively acting more like an inner join). In particular, rows containing null values are incorrectly filtered out by node_access (i.e., if the base table has null entries for the node ID, node_access denies access to all users based on those null values, even though they should have no relevance to node_access checks). The most common example is a view where rows disappear from the table after adding an optional relationship to the view.

The patch in https://www.drupal.org/files/issues/2023-06-12/drupal-node_access_for_left_joins_d7.3176634-34.patch appears to work after stripping out the testing changes

Steps To Reproduce

  1. enable Views
  2. Create a field referencing nodes
  3. Create a node having the entity reference field empty,
  4. Create a View with a relationship using the entity reference field. Do NOT select "Require this relationship".
  5. Expected result is that regular users can see the node in the View. Current result is that regular users cannot see the node.

Additional information

Add any other information that could help, such as:

  • Backdrop CMS version: 1.27.1

aitala avatar Mar 12 '24 20:03 aitala

This was recently committed for Drupal 10.3. The patch above is the backport and should apply pretty cleanly. I haven't looked at all the tests that are included in the patch, but nice to have them ready to go, too!

laryn avatar Mar 12 '24 21:03 laryn

@aitala I just ported the patch here, including tests, so let's see how it looks after tests have been run on the PR.

laryn avatar Mar 22 '24 18:03 laryn

I was comparing the function that gets modified here with the Drupal 7 version, and it may not be affecting things for this issue but this change has been committed in D7 (I added a comment in this other ticket as well): https://github.com/backdrop/backdrop-issues/issues/3775

laryn avatar Mar 25 '24 17:03 laryn