#365183 by Eaton: Fix for node_feed() silently discards ->content (with tests).

1 files changed, 16 insertions, 1 deletions

diff --git a/modules/node/node.module b/modules/node/node.module
index 3629e2209..afea14b39 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -1864,8 +1864,23 @@ function node_feed($nids = FALSE, $channel = array()) {
         $item = node_prepare($item, $teaser);
       }
 
-      // Allow modules to change $node->teaser before viewing.
+      // Allow modules to change $node->content before the node is rendered.
       node_invoke_nodeapi($item, 'view', $teaser, FALSE);
+
+      // Set the proper node property, then unset unused $node property so that a
+      // bad theme can not open a security hole.
+      $content = drupal_render($item->content);
+      if ($teaser) {
+        $item->teaser = $content;
+        unset($item->body);
+      }
+      else {
+        $item->body = $content;
+        unset($item->teaser);
+      }
+    
+      // Allow modules to modify the fully-built node.
+      node_invoke_nodeapi($item, 'alter', $teaser, FALSE);
     }
 
     // Allow modules to add additional item fields and/or modify $item