? 000-seven-form-css-sanity.patch
? 1
? 690828-block-ahah_0.patch
? 732542-system-goto-action-D7.patch
? 735528-states-or.patch
? 823428-entity-uri-34.patch
? 846296-file-download.patch
? 846296-file-download2.patch
? 890716-file-settings.patch
? 920614-node-access-new-column.patch
? 920614-node-access-unpublished-documentation.patch
? 920614-node-access.patch
? file_download_access6.patch
? test.patch
? sites/default/files
? sites/default/private
Index: modules/node/node.api.php
===================================================================
RCS file: /cvs/drupal/drupal/modules/node/node.api.php,v
retrieving revision 1.74
diff -u -p -r1.74 node.api.php
--- modules/node/node.api.php	25 Sep 2010 18:01:28 -0000	1.74
+++ modules/node/node.api.php	26 Sep 2010 16:17:43 -0000
@@ -138,7 +138,10 @@
  * an array of the list IDs that this user is a member of.
  *
  * A node access module may implement as many realms as necessary to
- * properly define the access privileges for the nodes.
+ * properly define the access privileges for the nodes. Note that the system
+ * makes no distinction between published and unpublished nodes. It is the
+ * module's responsibility to provide appropriate realms to limit access to
+ * unpublished content.
  *
  * @param $account
  *   The user object whose grants are requested.
@@ -169,6 +172,12 @@ function hook_node_grants($account, $op)
  * interested, it must respond with an array of permissions arrays for that
  * node.
  *
+ * Node access grants apply regardless of the published or unpublished status
+ * of the node. Implementations must make sure not to grant access to
+ * unpublished nodes if they don't want to change the standard access control
+ * behavior. Your module may need to create a separate access realm to handle
+ * access to unpublished nodes.
+ *
  * Note that the grant values in the return value from your hook must be
  * integers and not boolean TRUE and FALSE.
  *
@@ -177,7 +186,9 @@ function hook_node_grants($account, $op)
  *   hook_node_grants().
  * - 'gid': A 'grant ID' from hook_node_grants().
  * - 'grant_view': If set to 1 a user that has been identified as a member
- *   of this gid within this realm can view this node.
+ *   of this gid within this realm can view this node. This should usually be
+ *   set to $node->status. Failure to do so may expose unpublished content
+ *   to some users.
  * - 'grant_update': If set to 1 a user that has been identified as a member
  *   of this gid within this realm can edit this node.
  * - 'grant_delete': If set to 1 a user that has been identified as a member
@@ -187,6 +198,31 @@ function hook_node_grants($account, $op)
  *   priority will not be written. If there is any doubt, it is best to
  *   leave this 0.
  *
+ *
+ * When an implementation is interested in a node but want to deny access to
+ * everyone, it may return a "deny all" grant:
+ *
+ * @code
+ * $grants[] = array(
+ *   'realm' => 'all',
+ *   'gid' => 0,
+ *   'grant_view' => 0,
+ *   'grant_update' => 0,
+ *   'grant_delete' => 0,
+ *   'priority' => 1,
+ * );
+ * @endcode
+ *
+ * Setting the priority should cancel out other grants. In the case of a
+ * conflict between modules, it is safer to use hook_node_access_records_alter()
+ * to return only the deny grant.
+ *
+ * @param $node
+ *   The node that has just been saved.
+ *
+ * @return
+ *   An array of grants as defined above.
+ *
  * @ingroup node_access
  */
 function hook_node_access_records($node) {
@@ -197,7 +233,7 @@ function hook_node_access_records($node)
     $grants[] = array(
       'realm' => 'example',
       'gid' => 1,
-      'grant_view' => 1,
+      'grant_view' => $node->status,
       'grant_update' => 0,
       'grant_delete' => 0,
       'priority' => 0,
@@ -208,11 +244,12 @@ function hook_node_access_records($node)
     $grants[] = array(
       'realm' => 'example_author',
       'gid' => $node->uid,
-      'grant_view' => 1,
-      'grant_update' => 1,
-      'grant_delete' => 1,
+      'grant_view' => $node->status,
+      'grant_update' => $node->status,
+      'grant_delete' => $node->status,
       'priority' => 0,
     );
+
     return $grants;
   }
 }
@@ -234,6 +271,8 @@ function hook_node_access_records($node)
  * user must have one or more matching permissions in order to complete the
  * requested operation.
  *
+ * A module may deny all access to a node by setting $grants to an empty array.
+ *
  * @see hook_node_grants()
  * @see hook_node_grants_alter()
  *
@@ -277,6 +316,8 @@ function hook_node_access_records_alter(
  * The resulting grants are then checked against the records stored in the
  * {node_access} table to determine if the operation may be completed.
  *
+ * A module may deny all access to a user by setting $grants to an empty array.
+ *
  * @see hook_node_access_records()
  * @see hook_node_access_records_alter()
  *