Why can't a Drupal user edit a node they created?

Symptoms: An authorized Drupal user loses "edit" access to nodes they've created, even if they have appropriate node (or other module) access permissions. Or, user cannot edit a node that should be editable by them, based on access control or node access settings. No errors or warnings appear in the Drupal log.

Possible Cause: The user does not have permission to use the input filter assigned to the node. (Input filter permissions may have been changed since the node was created. As a result, the user never had, or no longer has permission to use the input filter associated with the node.)

This excerpt from Drupal node.module node_access() function tells the tale:


function node_access($op, $node = NULL, $uid = NULL) {
// Convert the node to an object if necessary:
if ($op != 'create') {
$node = (object)$node;
}

// If the node is in a restricted format, disallow editing.
if ($op == 'update' && !filter_access($node->format)) {
return FALSE;
}



So, if a node is created by a user with an input filter they once had access to, and the admin later removes access to that filter for the user (or edits the node and selects an input filter that the node owner/creator/editor cannot access), then the user will not be able to edit the node.

No warnings, no watchdog entries, nothing. An associated custom module (if any) hook_access is NOT called with $op='update'. The user just won't see the edit tab, or if the user tries to edit the node by visiting node/x/edit, user will see "access denied" messages.

Solution/workaround: Restore permission for the user to access the filter used when the content was first created (or last edited) OR, have a user (admin) who has access to the filters associated with the node edit the node and set the filter to one that the node creator/owner has access to. This will restore the update permission.

Here's a quick SQL query that shows content created using the nondefault filter and the user ids who created/own them.


SELECT nid, uid, title, format FROM {node_revisions} WHERE format <> {default_filter_id} AND uid <> 1;


Proposal for Drupal Core mod: At a minimum, node_access() function should create a watchdog entry when it rejects an update based on filter_access() returning FALSE. An example enhancement:


// If the node is in a restricted format, disallow editing.
if ($op == 'update' && !filter_access($node->format)) {
watchdog('node_access', "update access rejected for node $node->nid user lacks access to node's current input filter ($node->format)");
return FALSE;
}


Also, when an admin changes filter access permissions, it might be nice to let them know that this may cause users to lose edit access to some or all existing content.

Status: Drupal issue #91663 created