Views hides nodes with a blank entity reference field

[kswan]

Description of the bug

Views incorrectly filters out content where an entity reference field is blank in some specific situations. The conditions are:

• The view has a relationship configured to the Referenced Entity.
• A module is enabled that implements "node_grants".

This was originally reported in the content_access issue queue (backdrop-contrib/content_access#30), but I believe it is actually a core issue.

Steps To Reproduce

To reproduce the behavior:

1. Setup a Content Type with an entity reference field that targets a node.
2. Make sure you have a non-admin (not user 1) account with Bypass content access control permission is disabled.
3. Add some content to the content type where some content includes the entity reference and some does not.
4. Create a view filtered by the content type setup earlier, displayed as fields in a table. Including the entity reference field.
5. Add a Relationship to the view for the Entity Reference - Referenced Entity. Leave the "Require this relationship" unchecked.
6. Load the view from the non-admin account. At this point, you should see all content including the nodes with and without the entity reference field populated.
7. Enable any module that implements "node_grants", for example, content_access.
8. Rebuild Node access permissions.
9. Load the view again from the non-admin account.
10. This time you will only see the content where the entity reference field is populated. The view should include the nodes where the entity reference field is blank.

Actual behavior

Only the content where the entity reference field is populated is displayed.

Expected behavior

The same content shown in step 6 should be displayed.

Additional information

Add any other information that could help, such as:

• Backdrop CMS version: 1.30.0
• Web server and its version: Apache/2.4.58 (Ubuntu)
• PHP version: 8.3
• Database sever (MySQL or MariaDB?) and its version: 8.0.41-0ubuntu0.24.04.1
• Operating System and its version: Ubuntu 24.04

The views relationship configured to the Referenced Entity causes the following to be appended to the WHERE clause of the Views query:

AND ( EXISTS  (SELECT `na`.`nid` AS `nid`
FROM 
{node_access} `na`
WHERE (( (`na`.`gid` IN  ('0')) AND (`na`.`realm` = 'all') )OR( (`na`.`gid` IN  ('2')) AND (`na`.`realm` = 'content_access_author_unpublished') )OR( (`na`.`gid` IN  ('2')) AND (`na`.`realm` = 'content_access_author') )OR( (`na`.`gid` IN  ('222', '333', '337')) AND (`na`.`realm` = 'content_access_rid') ))AND (`na`.`grant_view` >= '1') AND (node_field_data_field_reference.nid = na.nid) )) 

This is only valid when the node_field_data_field_reference.nid is not null.

[olafgrabienski]

I've reproduced the steps from the issue description and can confirm the issue: Visitors see only the content of a view, where the content item's entity reference field has a value. After applying the PR to my test site, they see all the content. So, the fix works for me.

@kswan – One of the steps is to enable a module that implements "node_grants". Does it make sense to test the issue with other modules than Content Access, and which? (Or have you tested this already?)

[kswan]

@olafgrabienski Thank you for testing the PR.
After searching backdrop-contrib for modules that implement node_grants, these are affected.
Content Access - Confirmed using STR
Simple Access - Confirmed using STR
Content view access - Confirmed using STR
ACL - Confirmed using STR
Node access node reference - Confirmed using STR
View Unpublished - Confirmed using STR
Simple Access Grants - Confirmed using STR
Organic groups subgroups - Confirmed using STR
Node access user reference - Confirmed using STR
Organic Groups/og_access - Confirmed using STR
Taxonomy Access Control - Confirmed using STR
Taxonomy Access Control Lite - Confirmed using STR
Domain Access - Confirmed using STR
Access by Term (ABT) - Confirmed using STR
Forum Access - Confirmed using STR

[argiepiano]

I'm not able to reproduced. I have followed the steps very carefully, and double checked everything. I did leave the "require this relationship" unchecked. Is there a missing step?

Snapshots:

[olafgrabienski]

Is there a missing step?

Interesting! I was able to reproduce it with exactly the steps from the issue description. (The first time I wasn't, because I forgot to look at the view without the "Bypass content access control" permission.)

[kswan]

If you are logged in as User 1 or an account with "Bypass content access control", the issue doesn't' occur. I'll add the user 1 factor to the STR.

[argiepiano]

Still not able to reproduced. I'm logging in with another user (with editor role). Still able to see all nodes. What am I missing?