With the following code, if the current user does not have 'bypass node access' (see _node_query_node_access_alter() for exact verifications), then the query checks for node_access, even though I do not use the "node_access" tag.

How can I avoid the node_access check with the following query for a non-admin user?

I'm using this code from a module, so I can verify permissions myself, no need for node_access checks.

  $query = new EntityFieldQuery;
  $result = $query
    ->entityCondition('entity_type', 'node')
    ->entityCondition('bundle', 'foo')
    ->fieldCondition('custom_id', 'value', $custom_id)
    ->execute();
up vote 25 down vote accepted

Drupal 7.15 allows you to bypass the access on the node.

See DANGEROUS_ACCESS_CHECK_OPT_OUT query tag added to EntityFieldQuery for more information.

A "DANGEROUS_ACCESS_CHECK_OPT_OUT" query tag has been added to EntityFieldQuery to allow bypassing access checks. Previously, queries executed through EntityFieldQuery would always be altered by the node access system, potentially causing unexpected behaviour and data loss.

If you need to bypass access checks in an internal query within your module's API, you may add this tag, but you should only do so if it is necessary. If this query tag is added to a query whose results will be displayed to the user, it will bypass all access checks, potentially exposing sensitive information.

function MYMODULE_field_query($field) {
  $query = new EntityFieldQuery();
  return $query
    ->fieldCondition($field)
    ->addTag('DANGEROUS_ACCESS_CHECK_OPT_OUT')
    ->execute();
}
  • This is great, thank you! That answers the OP! – Weboide Sep 18 '12 at 19:45
  • Wow, I've been getting stuck by this for some time now without even realizing it. Love that it's "DANGEROUS" when there are innumerable innocuous uses for such queries. : P – Ryan Szrama Dec 23 '13 at 16:56

The answer is that you cannot.

The only workaround I can think of it to add an account metadata:

$query = new EntityFieldQuery;
$result = $query
  ->entityCondition('entity_type', 'node')
  ->entityCondition('bundle', 'foo')
  ->fieldCondition('custom_id', 'value', $custom_id)
  ->addMetaData('account', user_load(1))
  ->execute();

EDIT: a DANGEROUS_ACCESS_CHECK_OPT_OUT option has been added as part of the Drupal 7.15 security release.

  • That looks like a good workaround, thank you Damien! – Weboide Aug 9 '11 at 14:14

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.