diff --git a/modules/node/node.api.php b/modules/node/node.api.php index 8b8343d2ed0..03b5fb6df1a 100644 --- a/modules/node/node.api.php +++ b/modules/node/node.api.php @@ -281,9 +281,9 @@ function hook_nodeapi_prepare_translation($node) { * An RSS feed is being generated. * * The module can return properties to be added to the RSS item generated for - * this node. See comment_nodeapi_rss_item() and upload_nodeapi_rss_item() for - * examples. The $node passed can also be modified to add or remove contents to - * the feed item. + * this node. This hook should only be used to add XML elements to the RSS + * feed item itself. See comment_nodeapi_rss_item() and upload_nodeapi_rss_item() + * for examples. * * @param $node * The node the action is being performed on. diff --git a/modules/node/node.module b/modules/node/node.module index 3629e2209c6..afea14b39f5 100644 --- a/modules/node/node.module +++ b/modules/node/node.module @@ -1864,8 +1864,23 @@ function node_feed($nids = FALSE, $channel = array()) { $item = node_prepare($item, $teaser); } - // Allow modules to change $node->teaser before viewing. + // Allow modules to change $node->content before the node is rendered. node_invoke_nodeapi($item, 'view', $teaser, FALSE); + + // Set the proper node property, then unset unused $node property so that a + // bad theme can not open a security hole. + $content = drupal_render($item->content); + if ($teaser) { + $item->teaser = $content; + unset($item->body); + } + else { + $item->body = $content; + unset($item->teaser); + } + + // Allow modules to modify the fully-built node. + node_invoke_nodeapi($item, 'alter', $teaser, FALSE); } // Allow modules to add additional item fields and/or modify $item diff --git a/modules/node/node.test b/modules/node/node.test index 420499c7feb..531c22fe54a 100644 --- a/modules/node/node.test +++ b/modules/node/node.test @@ -598,4 +598,40 @@ class NodePostSettingsTestCase extends DrupalWebTestCase { $node = $this->drupalGetNodeByTitle($edit['title']); $this->assertNoRaw(theme('node_submitted', $node), t('Post information is not displayed.')); } -} \ No newline at end of file +} + +/** + * Ensure that data added to nodes by other modules appears in RSS feeds. + * + * Create a node, enable the node_test module to ensure that extra data is + * added to the node->content array, then verify that the data appears on the + * sitewide RSS feed at rss.xml. + */ +class NodeRSSContentTestCase extends DrupalWebTestCase { + function getInfo() { + return array( + 'name' => t('Node RSS Content'), + 'description' => t('Ensure that data added to nodes by other modules appears in RSS feeds.'), + 'group' => t('Node'), + ); + } + + function setUp() { + // Enable dummy module that implements hook_nodeapi_view. + parent::setUp('node_test'); + } + + /** + * Create a new node and ensure that it includes the custom data when added + * to an RSS feed. + */ + function testNodeRSSContent() { + // Create a node. + $node = $this->drupalCreateNode(array('type' => 'article', 'promote' => 1)); + + $test_text = t('Extra test data added to node !nid.', array('!nid' => $node->nid)); + + $this->drupalGet('rss.xml'); + $this->assertText($test_text, t('Extra node content appears in RSS feed.')); + } +} diff --git a/modules/node/node_test.info b/modules/node/node_test.info new file mode 100644 index 00000000000..2624f30c46f --- /dev/null +++ b/modules/node/node_test.info @@ -0,0 +1,8 @@ +; $Id$ +name = "Node module tests" +description = "Support module for node related testing." +package = Testing +version = VERSION +core = 7.x +files[] = node_test.module +hidden = TRUE diff --git a/modules/node/node_test.module b/modules/node/node_test.module new file mode 100644 index 00000000000..0a19606aa51 --- /dev/null +++ b/modules/node/node_test.module @@ -0,0 +1,18 @@ +content['node_test_extra_field'] = array( + '#markup' => '
' . t('Extra test data added to node !nid.', array('!nid' => $node->nid)) . '
', + '#weight' => 10, + ); +}