From 632648f394faaab743c3c6e7a48880ed450a49a6 Mon Sep 17 00:00:00 2001 From: Robert Date: Fri, 27 May 2016 10:06:36 +0200 Subject: [PATCH] Add domain to custom list query for administrators --- modules/custom_lists/custom_lists.module | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/modules/custom_lists/custom_lists.module b/modules/custom_lists/custom_lists.module index bd7b8fc..10cc1c4 100644 --- a/modules/custom_lists/custom_lists.module +++ b/modules/custom_lists/custom_lists.module @@ -297,6 +297,18 @@ function custom_lists_content_nodes($list, $items, $full_load = TRUE) { $query->join('taxonomy_index', 'ti', 'ti.nid = n.nid'); $query->condition('ti.tid', $list['taxonomy']); } + if (user_access('bypass node access') || user_access('administer nodes')) { + /* + * Custom lists should show only content assigned to the current domain. + * For regular users this is fixed by domain access itself. + * Administrators see content from all domains because domain access does not enforce node viewing restrictions. + * Gemeente Zwolle asked this to be fixed for administrators as well, so domain needs to be enforced in the query. + */ + global $_domain; + $domain_id = $_domain['domain_id']; + $query->innerJoin('domain_access', 'd', 'n.nid = d.nid'); + $query->condition('d.gid', $domain_id, '='); + } // Custom filters for certain use cases. if (!empty($list['extra-filters']) && $list['extra-filters'] != '_none') {