Why can't A Drupal user edit a node they created?

Why can't a Drupal user edit a node they created?

Symptoms: An authorized Drupal user loses "edit" access to nodes they've created, even if they have appropriate node (or other module) access permissions. Or, user cannot edit a node that should be editable by them, based on access control or node access settings. No errors or warnings are presented to the user. Nothing in the Drupal watchdog log.

Possible Cause: The user does not have permission to use the input filter currently assigned to the node. (An administrator or other privileged user may have changed the input filter settings, or, input filter permissions may have been changed to exclude the node author since the node was created. As a result, the user never had, or no longer has permission to use the input filter associated with the node.)

This excerpt from Drupal node.module node_access() function tells the tale:

function node_access($op, $node = NULL, $uid = NULL) {
  // Convert the node to an object if necessary:
  if ($op != 'create') {
    $node = (object)$node;
  }

  // If the node is in a restricted format, disallow editing.
  if ($op == 'update' && !filter_access($node->format)) {
    return FALSE;
  }

So, if a node is created by a user with an input filter that was accessible at the time (a necessity, actually), and the admin or some other privileged user later removes access to that filter for the node author (or edits the node and selects an input filter that the node owner/creator cannot access), then the user will not be able to edit the node.

No warnings, no watchdog entries, nothing. An associated custom module (if any) hook_access is NOT called with $op='update'. The user just won't see the edit tab, or if the user tries to edit the node by visiting node/x/edit, user will see "access denied" messages.

Solution/workaround: Restore permission for the user to access the filter used when the content was first created (or last edited) OR, have a user (admin) who has access to the filters associated with the node edit the node and set the filter to one that the node creator/owner has access to. This will restore the update permission.

Here's a quick SQL query that shows content created using the non-default filter and the user ids who created/own them.

SELECT nid, uid, title, format FROM {node_revisions} WHERE format <> {default_filter_id} AND uid <> 1;

Proposal for Drupal Core mod: At a minimum, the caller of the node_access() function could create a watchdog entry when it disabled the 'edit' tab based on filter_access() returning FALSE. An example enhancement:


// If the node is in a restricted format, disallow editing.
if ($op == 'update' && !filter_access($node->format)) {
  watchdog('node_access', "update access rejected for node $node->nid user lacks access to node's current input filter ($node->format)");
return FALSE;
}

Also, when an admin changes filter access permissions, it might be nice to let them know that this may cause users to lose edit access to some or all existing content.

Status: Drupal issue #91663 created