Why is my content not hidden?

Question

I set up a rule that blocks access to a specific piece of content. In fact, for simplicity's sake, I made a rule that blocks everything:

function namhost_node_access($node, $op, $account)
{   
    return NODE_ACCESS_DENY;
}

The problem is, if I go to:

/node

And browse through all the content, I still see data that I deliberately blocked. Why are these showing? Is /node some kind of view with full access to anonymous users? Is my access rule not being enforced for some other reason? Am I not understanding what the point of /node is and if I just block that path will I be fine?

Also, are there any other ways that people can access content types I've blocked? It's making me worried that I am able to access content that has been deliberately blocked.

Answer 1

Look at the documentation for hook_node_access, here:

https://api.drupal.org/api/drupal/modules%21node%21node.api.php/function/hook_node_access/7

The key is where it says:

Also note that this function isn't called for node listings (e.g., RSS feeds, the default home page at path 'node', a recent content block, etc.)

You probably want to check the link following that comment, i.e. the node access rights description, which got more complicated in D7 from D6.

Another thing to pay attention to is: if you're logged in as user id 1, then you won't be affected by those node access grants.

Answer 2

The /node path is a default setting that was created to allow for an easy feed of content to users.

You will most likely want to set your default homepage to something other then /node

This will allow you to use a static page, a generated view or a panel.

You can update that setting at:

/admin/config/system/site-information

If you do want to leave it as the default /node but not have any items show up, you can put something like this in a custom module or your theme.

function MYTHEME_preprocess_page(&$vars) {
  if (drupal_is_front_page()) {
    // Removes message "no front page content is created".
    unset($vars['page']['content']['system_main']['default_message']);
    // Removes welcome message page title.
    drupal_set_title('');
  }
}