Skip to content

Nodequeue access check fails due to incorrect role ID detection in nodequeue_queue_access() #41

@sojo

Description

@sojo

The nodequeue_queue_access() function incorrectly uses array_keys() to extract role IDs from $account->roles. This breaks access checks when the $user->roles array contains numerically indexed role names instead of keyed role IDs

As a result, users with valid roles assigned to a queue cannot access or manipulate it.

Example

$account->roles = [
  0 => 'authenticated',
  1 => 26,
  2 => 50,
];

But nodequeue_queue_access() does:

nodequeue-access-fix.patch

$roles = array_keys((array) $account->roles); // [0, 1, 2]

This fails the access check.

Fix:
Replace:
$roles = array_keys((array) $account->roles) + array(BACKDROP_AUTHENTICATED_ROLE);

With:
$roles = array_values((array) $account->roles);

This ensures the role IDs are matched correctly against $queue->roles.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions