Download denied even if one of the nodes containing the file is not accessible

Created on 21 March 2014, almost 11 years ago
Updated 29 June 2024, 6 months ago

The comments in the following code block from the function _download_count_get_nodes_by_filefield says that
"if access is denied for ALL nodes containing the file, deny the download as well" but the code logic is the other way around i.e "if access is denied for EVEN one node containing the file, deny the download as well"

// So the overall field view permissions are not denied, but if access is
  // denied for ALL nodes containing the file, deny the download as well.
  // Node access checks also include checking for 'access content'.
  $nodes = array();
 $denied = FALSE;
  foreach ($cck_files as $field_name => $field_files) {
    foreach ($field_files as $revision_id => $content) {
      // Checking separately for each revision is probably not the best idea -
      // what if 'view revisions' is disabled? So, let's just check for the
      // current revision of that node.
      if (isset($nodes[$content['nid']])) {
        continue; // Don't check the same node twice.
      }
   if ($denied == FALSE && ($node = node_load($content['nid'])) && node_access('view', $node) == FALSE)   {
        // You don't have permission to view the node this file is attached to.
      $denied = TRUE;
      }
      $nodes[$content['nid']] = $node;
    }
    if ($denied) {
      return FALSE; // inaccessible
    }
  }

I am using the code with the following changes

 $nodes = array();
// $denied = FALSE;
  $denied = TRUE;
.
.
.
// if ($denied == FALSE && ($node = node_load($content['nid'])) && node_access('view', $node) == FALSE)   
  if ($denied == TRUE && ($node = node_load($content['nid'])) && node_access('view', $node) == TRUE)   
{
        // You don't have permission to view the node this file is attached to.
  //  $denied = TRUE;
      $denied = FALSE;
}
   $nodes[$content['nid']] = $node;
.
.
.

Correct me if I misunderstood.

💬 Support request
Status

Closed: outdated

Version

2.0

Component

Code

Created by

🇮🇳India msmani

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024