I am trying to use the Drupal node access API to determine whether a node is subject to an access restriction. That is: I want to make sure that the node can be viewed by any authenticated user (provided the authenticated user is granted the right to view published content).

The function node_access('view, $node, $account); returns TRUE if the user object $account can access $node, and FALSE otherwise, so I can get the correct result stored in $view_for_all with the following snippet of code:

$accounts = entity_load('user');
$view_for_all = TRUE;
foreach ($accounts as $account) {
  if (!node_access('view', $node, $account)) {
    $view_for_all = FALSE;

However, looping through all accounts will be very slow if there are, say, 50000 users. I am looking for a more efficient way to do this.

  • Isn't this a duplicate of How to debug permissions?? Also, if it's supposed to be available to all logged-in users, why not to simply grant permission to authenticated role? – Mołot Jul 28 '14 at 14:41
  • I say not a dup as this is a specific case and not generic permissions debug. – mpdonadio Jul 28 '14 at 14:44
  • @Mołot, no I am not trying to debug permissions. This is for a production site. The use case is that I only want to allow a certain field to be populated if there are no view access restrictions imposed on the node the field is attached to. I.e. want to check this, and not show the field in the form if there is some sort of access restriction on the node. I don't own the node, so can't know what sort of node access modules the admin has enabled. – Free Radical Jul 28 '14 at 14:44
  • As you both can see, I just asked, not voted. – Mołot Jul 28 '14 at 14:47

This is surely impossible. Modules can decide on the fly which nodes are visible. https://api.drupal.org/api/drupal/modules!node!node.api.php/function/hook_node_access/7

| improve this answer | |

If you are needing to check node_access records, then you may be able to examine them similarly to how devel_node_access does. In the end, all nodes have grants added to the node_access table, so if there are grants that deny or restrictively add access, then you can probably see it there.

Another option would be to have a dummy account that is an authenticated user, and used as the test case. This will fail, of course, if you need to detect grant rules that deny access to authenticated users who would otherwise be entitled. It's a sticky situation.

The hardest part about this question is that it seems as though you are looking for a general solution to a specific problem, and I'm not quite sure that a general solution exists.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.