Horrible permissions bug, anonymous users can edit products I have a Drupal Commerce site. I'm using Content Access to only allow users with the role "Vendor" to "Edit own product." Nobody else is allowed to edit any products. This is the only module I'm using afaik that controls permissions.

And yet.... everybody is able to edit all products! Even guests! This bug is horrifying.

I've tried


clearing all caches
emptying the node_access DB table
Rebuilding permissions from the status report
completely disabling editing products for anyone
disabling and uninstalling the Content Access module


Here is my access control for the Product content type (it was originally called Produce, hence the machine name being produce)



And yet when I go to view a product, even as an anonymous guest, it shows the "View" and "Edit" tabs. And when I click "Edit" I can actually change the content and save the node!

One node example is node id 78. If I look at the node_access table in the DB, it shows this:

nid   gid   realm   grant_view   grant_update   grant_delete
78    0     all     1            0              0


If rebuilding permissions doesn't work, disabling Content Access doesn't work, then.... I have no idea where to go from here.

Update

I've installed Devel and am checking which modules implement hook_node_access

$ drush fn-hook node_access
Enter the number of the hook implementation you wish to view.
 [0]  :  Cancel
 [1]  :  commerce_marketplace
 [2]  :  node
 [3]  :  features
Node access rights can be a little hard to debug.  You need to enable the Devel module, and the Devel Node Access submodule.

Then goto your block configuration.  There will be two new blocks: Devel Node Access and Devel Node Access By User.  Add these to your page, and configure them for your admin role(s).  Also goto the Devel settings (admin/config/development/devel) and enable Devel Node Access debug mode.

Then visit a page with access problems.  Look at the debug info.

The Devel Node Access block will show you the {node_access} rows for the node in question.

The Devel Node Access By User block will show you who has permission to do what, and why.

Then you need to do some sleuthing.  If it is a permission, then you need to find that permission and edit it.  If it is a hook_node_access(), then you need to find the module that is implementing it.  If it is a grant, then you need to use the realm/gid and track down who is implementing a hook_node_access_records() with that pair.

The module_implements() function can be used to track down who is implementing what.  I typically do this with

drush php-eval 'print_r(module_implements("node_access"))';
drush php-eval 'print_r(module_implements("node_access_records"))';


My guess is that one of your features has a rogue hook_node_access() in it.  You could also try disabling your features one by one and seeing what happens.