#365183 by Eaton: Fix for node_feed() silently discards ->content (with tests).

5 files changed, 82 insertions, 5 deletions

diff --git a/modules/node/node.api.php b/modules/node/node.api.php
index 8b8343d2e..03b5fb6df 100644
--- a/modules/node/node.api.php
+++ b/modules/node/node.api.php
@@ -281,9 +281,9 @@ function hook_nodeapi_prepare_translation($node) {
  * An RSS feed is being generated.
  *
  * The module can return properties to be added to the RSS item generated for
- * this node. See comment_nodeapi_rss_item() and upload_nodeapi_rss_item() for
- * examples. The $node passed can also be modified to add or remove contents to
- * the feed item.
+ * this node. This hook should only be used to add XML elements to the RSS
+ * feed item itself. See comment_nodeapi_rss_item() and upload_nodeapi_rss_item()
+ * for examples.
  *
  * @param $node
  *   The node the action is being performed on.
diff --git a/modules/node/node.module b/modules/node/node.module
index 3629e2209..afea14b39 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -1864,8 +1864,23 @@ function node_feed($nids = FALSE, $channel = array()) {
         $item = node_prepare($item, $teaser);
       }
 
-      // Allow modules to change $node->teaser before viewing.
+      // Allow modules to change $node->content before the node is rendered.
       node_invoke_nodeapi($item, 'view', $teaser, FALSE);
+
+      // Set the proper node property, then unset unused $node property so that a
+      // bad theme can not open a security hole.
+      $content = drupal_render($item->content);
+      if ($teaser) {
+        $item->teaser = $content;
+        unset($item->body);
+      }
+      else {
+        $item->body = $content;
+        unset($item->teaser);
+      }
+    
+      // Allow modules to modify the fully-built node.
+      node_invoke_nodeapi($item, 'alter', $teaser, FALSE);
     }
 
     // Allow modules to add additional item fields and/or modify $item
diff --git a/modules/node/node.test b/modules/node/node.test
index 420499c7f..531c22fe5 100644
--- a/modules/node/node.test
+++ b/modules/node/node.test
@@ -598,4 +598,40 @@ class NodePostSettingsTestCase extends DrupalWebTestCase {
     $node = $this->drupalGetNodeByTitle($edit['title']);
     $this->assertNoRaw(theme('node_submitted', $node), t('Post information is not displayed.'));
   }
-}
\ No newline at end of file
+}
+
+/**
+ * Ensure that data added to nodes by other modules appears in RSS feeds.
+ * 
+ * Create a node, enable the node_test module to ensure that extra data is
+ * added to the node->content array, then verify that the data appears on the
+ * sitewide RSS feed at rss.xml.
+ */
+class NodeRSSContentTestCase extends DrupalWebTestCase {
+  function getInfo() {
+    return array(
+      'name' => t('Node RSS Content'),
+      'description' => t('Ensure that data added to nodes by other modules appears in RSS feeds.'),
+      'group' => t('Node'),
+    );
+  }
+
+  function setUp() {
+    // Enable dummy module that implements hook_nodeapi_view.
+    parent::setUp('node_test');
+  }
+
+  /**
+   * Create a new node and ensure that it includes the custom data when added
+   * to an RSS feed.
+   */
+  function testNodeRSSContent() {
+    // Create a node.
+    $node = $this->drupalCreateNode(array('type' => 'article', 'promote' => 1));
+
+    $test_text = t('Extra test data added to node !nid.', array('!nid' => $node->nid));
+
+    $this->drupalGet('rss.xml');
+    $this->assertText($test_text, t('Extra node content appears in RSS feed.'));
+  }
+}
diff --git a/modules/node/node_test.info b/modules/node/node_test.info
new file mode 100644
index 000000000..2624f30c4
--- /dev/null
+++ b/modules/node/node_test.info
@@ -0,0 +1,8 @@
+; $Id$
+name = "Node module tests"
+description = "Support module for node related testing."
+package = Testing
+version = VERSION
+core = 7.x
+files[] = node_test.module
+hidden = TRUE
diff --git a/modules/node/node_test.module b/modules/node/node_test.module
new file mode 100644
index 000000000..0a19606aa
--- /dev/null
+++ b/modules/node/node_test.module
@@ -0,0 +1,18 @@
+<?php
+// $Id$
+
+/**
+ * @file
+ * Dummy module implementing node related hooks to test API interaction with
+ * the Node module.
+ */
+
+/**
+ * When the module is enabled, text will be added to all nodes in all build modes.
+ */
+function node_test_nodeapi_view($node, $teaser) {
+  $node->content['node_test_extra_field'] = array(
+    '#markup' => '<p>' . t('Extra test data added to node !nid.', array('!nid' => $node->nid)) . '</p>',
+    '#weight' => 10,
+  );
+}