Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

I have a Drupal Commerce site. I'm using Content Access to only allow users with the role "Vendor" to "Edit own product." Nobody else is allowed to edit any products. This is the only module I'm using afaik that controls permissions.

And yet.... everybody is able to edit all products! Even guests! This bug is horrifying.

I've tried

  • clearing all caches
  • emptying the node_access DB table
  • Rebuilding permissions from the status report
  • completely disabling editing products for anyone
  • disabling and uninstalling the Content Access module

Here is my access control for the Product content type (it was originally called Produce, hence the machine name being produce)

enter image description here

And yet when I go to view a product, even as an anonymous guest, it shows the "View" and "Edit" tabs. And when I click "Edit" I can actually change the content and save the node!

One node example is node id 78. If I look at the node_access table in the DB, it shows this:

nid   gid   realm   grant_view   grant_update   grant_delete
78    0     all     1            0              0

If rebuilding permissions doesn't work, disabling Content Access doesn't work, then.... I have no idea where to go from here.

Update

I've installed Devel and am checking which modules implement hook_node_access

$ drush fn-hook node_access
Enter the number of the hook implementation you wish to view.
 [0]  :  Cancel
 [1]  :  commerce_marketplace
 [2]  :  node
 [3]  :  features
share|improve this question
    
Do you use drush? What does drush php-eval 'module_implements("node_access");' list? hook_node_access() doesn't get recorded in the node_access table. –  MPD Apr 3 at 20:11
    
FWIW this doesn't appear to be a bug with Drupal Commerce - I've just checked three separate sites and none have this issue –  Clive Apr 3 at 20:14
    
@MPD sorry ran drush from the wrong folder. When I run that I get no output. –  andrewtweber Apr 3 at 20:16
1  
First of all, Commerce create producs as separate entities from nodes. If your products are nodes there's something weird there (AFAIK, but I haven't used last Commerce releases, or you are talking about Product Displays). Secondly, this is not a Drupal nor Commerce bug, I can assure you. This must be a bad configuration issue. Some permissions bypass some security checks (like Content Access). You should check anonymous user permissions in the permissions page, specially the nodes and products related ones. –  tunic Apr 3 at 20:18
    
@tunic The only box checked for anonymous users is "View published content." I'm using Product Variations so yes, there is both a Content Type and a Product Variation Type. On the permissions page I have "Create" and "View own" checked for both, for Vendors only. –  andrewtweber Apr 3 at 20:23

1 Answer 1

up vote 4 down vote accepted

Node access rights can be a little hard to debug. You need to enable the Devel module, and the Devel Node Access submodule.

Then goto your block configuration. There will be two new blocks: Devel Node Access and Devel Node Access By User. Add these to your page, and configure them for your admin role(s). Also goto the Devel settings (admin/config/development/devel) and enable Devel Node Access debug mode.

Then visit a page with access problems. Look at the debug info.

The Devel Node Access block will show you the {node_access} rows for the node in question.

The Devel Node Access By User block will show you who has permission to do what, and why.

Then you need to do some sleuthing. If it is a permission, then you need to find that permission and edit it. If it is a hook_node_access(), then you need to find the module that is implementing it. If it is a grant, then you need to use the realm/gid and track down who is implementing a hook_node_access_records() with that pair.

The module_implements() function can be used to track down who is implementing what. I typically do this with

drush php-eval 'print_r(module_implements("node_access"))';
drush php-eval 'print_r(module_implements("node_access_records"))';

My guess is that one of your features has a rogue hook_node_access() in it. You could also try disabling your features one by one and seeing what happens.

share|improve this answer
    
Thank you a million times. The Devel blocks are telling me exactly which module is the problem child. I haven't figured out why it's doing this, especially when it was working before - maybe a buggy upgrade - but this is a huge help. –  andrewtweber Apr 4 at 0:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.