I have a Drupal Commerce site. I'm using Content Access to only allow users with the role "Vendor" to "Edit own product." Nobody else is allowed to edit any products. This is the only module I'm using afaik that controls permissions.

And yet.... everybody is able to edit all products! Even guests! This bug is horrifying.

I've tried

  • clearing all caches
  • emptying the node_access DB table
  • Rebuilding permissions from the status report
  • completely disabling editing products for anyone
  • disabling and uninstalling the Content Access module

Here is my access control for the Product content type (it was originally called Produce, hence the machine name being produce)

enter image description here

And yet when I go to view a product, even as an anonymous guest, it shows the "View" and "Edit" tabs. And when I click "Edit" I can actually change the content and save the node!

One node example is node id 78. If I look at the node_access table in the DB, it shows this:

nid   gid   realm   grant_view   grant_update   grant_delete
78    0     all     1            0              0

If rebuilding permissions doesn't work, disabling Content Access doesn't work, then.... I have no idea where to go from here.


I've installed Devel and am checking which modules implement hook_node_access

$ drush fn-hook node_access
Enter the number of the hook implementation you wish to view.
 [0]  :  Cancel
 [1]  :  commerce_marketplace
 [2]  :  node
 [3]  :  features
  • Do you use drush? What does drush php-eval 'module_implements("node_access");' list? hook_node_access() doesn't get recorded in the node_access table.
    – mpdonadio
    Commented Apr 3, 2014 at 20:11
  • FWIW this doesn't appear to be a bug with Drupal Commerce - I've just checked three separate sites and none have this issue
    – Clive
    Commented Apr 3, 2014 at 20:14
  • @MPD sorry ran drush from the wrong folder. When I run that I get no output.
    – user11312
    Commented Apr 3, 2014 at 20:16
  • 1
    First of all, Commerce create producs as separate entities from nodes. If your products are nodes there's something weird there (AFAIK, but I haven't used last Commerce releases, or you are talking about Product Displays). Secondly, this is not a Drupal nor Commerce bug, I can assure you. This must be a bad configuration issue. Some permissions bypass some security checks (like Content Access). You should check anonymous user permissions in the permissions page, specially the nodes and products related ones.
    – sanzante
    Commented Apr 3, 2014 at 20:18
  • @tunic The only box checked for anonymous users is "View published content." I'm using Product Variations so yes, there is both a Content Type and a Product Variation Type. On the permissions page I have "Create" and "View own" checked for both, for Vendors only.
    – user11312
    Commented Apr 3, 2014 at 20:23

1 Answer 1


Node access rights can be a little hard to debug. You need to enable the Devel module, and the Devel Node Access submodule.

Then goto your block configuration. There will be two new blocks: Devel Node Access and Devel Node Access By User. Add these to your page, and configure them for your admin role(s). Also goto the Devel settings (admin/config/development/devel) and enable Devel Node Access debug mode.

Then visit a page with access problems. Look at the debug info.

The Devel Node Access block will show you the {node_access} rows for the node in question.

The Devel Node Access By User block will show you who has permission to do what, and why.

Then you need to do some sleuthing. If it is a permission, then you need to find that permission and edit it. If it is a hook_node_access(), then you need to find the module that is implementing it. If it is a grant, then you need to use the realm/gid and track down who is implementing a hook_node_access_records() with that pair.

The module_implements() function can be used to track down who is implementing what. I typically do this with

drush php-eval 'print_r(module_implements("node_access"))';
drush php-eval 'print_r(module_implements("node_access_records"))';

My guess is that one of your features has a rogue hook_node_access() in it. You could also try disabling your features one by one and seeing what happens.

  • Thank you a million times. The Devel blocks are telling me exactly which module is the problem child. I haven't figured out why it's doing this, especially when it was working before - maybe a buggy upgrade - but this is a huge help.
    – user11312
    Commented Apr 4, 2014 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.