diff --git a/core/modules/node/node.admin.inc b/core/modules/node/node.admin.inc index 3dd5344..9cd853e 100644 --- a/core/modules/node/node.admin.inc +++ b/core/modules/node/node.admin.inc @@ -455,20 +455,20 @@ function node_admin_nodes() { // If the user is allowed to bypass node access or if the user is allowed to // view all unpublished content, then we don't need to add any extra checks. - if (!user_access('bypass node access') && !user_access('view unpublished content')) { - // If the user is able to view their own unpublished nodes, allow them - // to see these in addition to published nodes. Check that they actually - // have some unpublished nodes to view before adding the condition. - if (user_access('view own unpublished content') && $own_unpublished = db_query('SELECT nid FROM {node} WHERE uid = :uid AND status = :status', array(':uid' => $GLOBALS['user']->uid, ':status' => 0))->fetchCol()) { - $query->condition(db_or() - ->condition('n.status', 1) - ->condition('n.nid', $own_unpublished, 'IN') - ); - } - else { - // If not, restrict the query to published nodes. - $query->condition('n.status', 1); - } + if (!user_access('bypass node access') && !user_access('view any unpublished content')) { + // If the user is able to view their own unpublished nodes, allow them + // to see these in addition to published nodes. Check that they actually + // have some unpublished nodes to view before adding the condition. + if (user_access('view own unpublished content') && $own_unpublished = db_query('SELECT nid FROM {node} WHERE uid = :uid AND status = :status', array(':uid' => $GLOBALS['user']->uid, ':status' => 0))->fetchCol()) { + $query->condition(db_or() + ->condition('n.status', 1) + ->condition('n.nid', $own_unpublished, 'IN') + ); + } + else { + // If not, restrict the query to published nodes. + $query->condition('n.status', 1); + } } $nids = $query ->fields('n',array('nid')) diff --git a/core/modules/node/node.module b/core/modules/node/node.module index 9b2628c..aa9edc7 100644 --- a/core/modules/node/node.module +++ b/core/modules/node/node.module @@ -1606,8 +1606,8 @@ function node_permission() { 'view own unpublished content' => array( 'title' => t('View own unpublished content'), ), - 'view unpublished content' => array( - 'title' => t('View unpublished content'), + 'view any unpublished content' => array( + 'title' => t('View any unpublished content'), ), 'view revisions' => array( 'title' => t('View content revisions'), @@ -2314,7 +2314,7 @@ function node_get_recent($number = 10) { $query = db_select('node', 'n'); // If the user is allowed to bypass node access or if the user is allowed to // view all unpublished content, then we don't need to add any extra checks. - if (!user_access('bypass node access') && !user_access('view unpublished content')) { + if (!user_access('bypass node access') && !user_access('view any unpublished content')) { // If the user is able to view their own unpublished nodes, allow them // to see these in addition to published nodes. Check that they actually // have some unpublished nodes to view before adding the condition. @@ -3060,10 +3060,10 @@ function node_access($op, $node, $account = NULL) { // Check access for unpublished nodes. if ($op == 'view' && !$node->status ) { - // Allow access if the user can view unpublished content or if the user is - // viewing his own content and has the 'view own unpublished content' + // Allow access if the user can view any unpublished content or if the user + // is viewing his own content and has the 'view own unpublished content' // permission. - if (user_access('view unpublished content', $account) + if (user_access('view any unpublished content', $account) || (user_access('view own unpublished content', $account) && $account->uid != 0 && $account->uid == $node->uid)) { $rights[$account->uid][$cid][$op] = TRUE; return TRUE; diff --git a/core/modules/node/node.test b/core/modules/node/node.test index 8c2ae8c..7340e8b 100644 --- a/core/modules/node/node.test +++ b/core/modules/node/node.test @@ -879,11 +879,11 @@ class NodeAccessUnitTest extends DrupalWebTestCase { $this->assertNodeAccess(array('view' => TRUE, 'update' => FALSE), $node4, $web_user4); $this->assertNodeAccess(array('view' => FALSE), $node4, $web_user5); - // User with 'view unpublished content' can view own unpublished content. - $web_user6 = $this->drupalCreateUser(array('access content', 'view unpublished content')); + // User with 'view any unpublished content' can view own unpublished content. + $web_user6 = $this->drupalCreateUser(array('access content', 'view any unpublished content')); $node5 = $this->drupalCreateNode(array('status' => 0, 'uid' => $web_user6->uid)); $this->assertNodeAccess(array('view' => TRUE, 'update' => FALSE), $node5, $web_user6); - // User with 'view unpublished content' can view other users unpublished + // User with 'view any unpublished content' can view other users unpublished // content. $this->assertNodeAccess(array('view' => TRUE, 'update' => FALSE), $node4, $web_user6);