0

Observations:

  1. Anonymous users can view nodes of a certain type
  2. Cron runs as an anonymous user
  3. Cron cannot access nodes of this type when using EntityFieldQuery
  4. Cron can access nodes of this type when the tag 'DANGEROUS_ACCESS_CHECK_OPT_OUT' is added to the query.

It seems to me that DANGEROUS_ACCESS_CHECK_OPT_OUT is a misnomer and should actually be DANGEROUS_ACCESS_CHECK_OPT_IN. If access was checked, Cron would know that anonymous users have access to this type of node, or am I missing something?

Based on the initial comments I think my question is not clear, so I am going to rephrase it. What I am seeing is that I allow the anonymous user to see this type of node, but Cron cannot query it. The references to this issue are ambiguous about the reason. If Cron runs as an anonymous user, then Cron should not get different access than an anonymous site user. Or Cron does not run with any user profile at all. That would actually make sense, but that is not how people explain this. So what is really going on? Is the flag a misnomer, or do people not make a clear distinction between "anonymous user" and "no user"?

Improve this question

2 Answers 2

Reset to default
1

I read it more as "Dangerous, Access Check Opt Out"

Improve this answer
1

It is used to by-pass the access control Drupal implements for entities and their fields. It is normally used for querying entities that are not shown to the user, for example user accounts that have never been used to access the site and that needs to be removed basing on the content of some fields, the nodes assigned to the currently logged-in user who requested the cancellation of their account and which needs to be deleted.
The EntityFieldQuery class assumes the data is being showed to the user currently logged-in (and verifies the user has access to the entity being queried), but that is not always the case, as in the case of functions automatically running as cron tasks.

So, Alex Laughnan correctly reads it as "Dangerous: Access check is being opted out."

Improve this answer
1
  • I rephrased my question. the intent is clear to me, but e.g. see drupal.org/node/2154245 and other references to Cron impersonating the anonymous user. My question is - why does the anonymous user not get the same access in Cron than he does on the site?
    – cdonner
    Commented Feb 23, 2015 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.