1

I have had problems with my permissions ever since I last rebuilt my permissions. (I did this after working on user reference permissions. This field has no user reference on it)

The taxonomy permissions have the same priority of 0. In fact all access modules have the priority of zero. When I go to the page that can be seen even though it should not be seen, it shows the following as granting access to view the page:

enter image description here

I think that I have to give people access to see pages by default and then take it away if taxonomy is assigned. I had this working before and I don't understand why it stopped working.

What can I do to figure this out? I'm a few hours into the issue and am a bit stumped.

I have the following modules installed regarding permissions:

  • Content Access
  • Node access user reference
  • Taxonomy Access Control

I'm not sure if it is relevant or not but I also get a message when I hover over delete that says:

DNA and Core seem to disagree on this item. This is a bug in either one of them and should be fixed! Try to look at this node as this user and check whether there is still disagreement.

1

The access record you are seeing could be the default access that Drupal uses and that, as far as I can say looking at the code, is only used when no module implements node access rights.
node_access_rebuild() and node_access_acquire_grants() both add that access record if no module implements any node access hook, or no module returns any access record.

function node_access_rebuild($batch_mode = FALSE) {
  db_query("DELETE FROM {node_access}");
  // Only recalculate if the site is using a node_access module.
  if (count(module_implements('node_grants'))) {
    // …
  else {
    // Not using any node_access modules. Add the default grant.
    db_query("INSERT INTO {node_access} VALUES (0, 0, 'all', 1, 0, 0)");
  }

  if (!isset($batch)) {
    drupal_set_message(t('Content permissions have been rebuilt.'));
    node_access_needs_rebuild(FALSE);
    cache_clear_all();
  }
}

I would not suggest to remove that access record from the node access table, otherwise users without specific permissions would not be able to view any node for which a module doesn't have a node access record. In Drupal, it is default to deny the access to a node; in fact, the node module writes in the node access table only the records that allow to access a node.

Update: As you reported that you are using also Content Access, you could be interested in this issue report: Do not hijack the 'all' realm.
The access record you are noticing is probably the record added by Content Access; the short name of the module is content_access, and it is probable the module is using that as grant realm.

I think that I have to give people access to see pages by default and then take it away if taxonomy is assigned.

As Drupal node access works, the access is denied by default, and it is granted for nodes for which a module grants it; it is exactly the opposite of what you are doing.
Access is still allowed for users who have specific permissions, which in Drupal 6 means users with the administer nodes permission, and is not allowed for users without a specific permission, which in Drupal 6 means users without the access content permission.

  • This might make sense. However, If you can see above, I added the list showing that other modules should have affected this node. It then seems that the current_access piece is overriding everything else. I have someone recreated the bug on a non development site. I will see if I can show the same type of info for a user than now has permission to see the pages. – Scott Mar 22 '11 at 17:58
  • I will go in and check that article. Thanks. I'm so stumped. I have 10+ hours of trouble shooting easy here. thanks again. – Scott Mar 22 '11 at 18:15
  • OK. I checked it out, I unchecked "access content" for both authenticated and authenticated users. It says in the post: "If the administrator grants View access to anonymous and authenticated users, CA creates a grant in the 'all' realm, as core does for nodes that receive no grants whatsoever." I'm now rebuilding the permissions which normally takes half an hour to an hour b/c of the number of nodes in the system. I'm nervous though, will this break my homepage if I use a panel for the homepage? My assumption was yes but I could be out in left field.... – Scott Mar 22 '11 at 18:31
  • @Scott: I think it should not break your homepage. By default, users with permission to access content should see any content; what can happen is that the homepage is not viewed by who should view it, but the page is not "destroyed." Changing the access records back should resolve the issue. – kiamlaluno Mar 22 '11 at 18:38
  • At least during the rebuild process, my homepage stopped working. It says "access denied." I have a panel with the login form embedded as my homepage. I have never understood 100% why it did that. – Scott Mar 22 '11 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.