How to bypass node_access when using EntityFieldQuery?

Question

With the following code, if the current user does not have 'bypass node access' (see _node_query_node_access_alter() for exact verifications), then the query checks for node_access, even though I do not use the "node_access" tag.

How can I avoid the node_access check with the following query for a non-admin user?

I'm using this code from a module, so I can verify permissions myself, no need for node_access checks.

  $query = new EntityFieldQuery;
  $result = $query
    ->entityCondition('entity_type', 'node')
    ->entityCondition('bundle', 'foo')
    ->fieldCondition('custom_id', 'value', $custom_id)
    ->execute();

Answer 1

Drupal 7.15 allows you to bypass the access on the node.

See DANGEROUS_ACCESS_CHECK_OPT_OUT query tag added to EntityFieldQuery for more information.

A "DANGEROUS_ACCESS_CHECK_OPT_OUT" query tag has been added to EntityFieldQuery to allow bypassing access checks. Previously, queries executed through EntityFieldQuery would always be altered by the node access system, potentially causing unexpected behaviour and data loss.

If you need to bypass access checks in an internal query within your module's API, you may add this tag, but you should only do so if it is necessary. If this query tag is added to a query whose results will be displayed to the user, it will bypass all access checks, potentially exposing sensitive information.

function MYMODULE_field_query($field) {
  $query = new EntityFieldQuery();
  return $query
    ->fieldCondition($field)
    ->addTag('DANGEROUS_ACCESS_CHECK_OPT_OUT')
    ->execute();
}

Answer 2

The answer is that you cannot.

The only workaround I can think of it to add an account metadata:

$query = new EntityFieldQuery;
$result = $query
  ->entityCondition('entity_type', 'node')
  ->entityCondition('bundle', 'foo')
  ->fieldCondition('custom_id', 'value', $custom_id)
  ->addMetaData('account', user_load(1))
  ->execute();

EDIT: a DANGEROUS_ACCESS_CHECK_OPT_OUT option has been added as part of the Drupal 7.15 security release.

Answer 3

For Drupal 8 you can use:

$query->accessCheck(FALSE);