I have a Drupal Commerce site. I'm using
Content Access to only allow users with the role "Vendor" to "Edit own product." Nobody else is allowed to edit any products. This is the only module I'm using afaik that controls permissions.
And yet.... everybody is able to edit all products! Even guests! This bug is horrifying.
- clearing all caches
- emptying the node_access DB table
- Rebuilding permissions from the status report
- completely disabling editing products for anyone
- disabling and uninstalling the Content Access module
Here is my access control for the Product content type (it was originally called Produce, hence the machine name being
And yet when I go to view a product, even as an anonymous guest, it shows the "View" and "Edit" tabs. And when I click "Edit" I can actually change the content and save the node!
One node example is node id 78. If I look at the
node_access table in the DB, it shows this:
nid gid realm grant_view grant_update grant_delete 78 0 all 1 0 0
If rebuilding permissions doesn't work, disabling Content Access doesn't work, then.... I have no idea where to go from here.
I've installed Devel and am checking which modules implement
$ drush fn-hook node_access Enter the number of the hook implementation you wish to view.  : Cancel  : commerce_marketplace  : node  : features