diff --git a/core/modules/book/src/BookManager.php b/core/modules/book/src/BookManager.php index bbdcc86..8d360b3 100644 --- a/core/modules/book/src/BookManager.php +++ b/core/modules/book/src/BookManager.php @@ -977,11 +977,11 @@ protected function doBookTreeCheckAccess(&$tree) { */ public function bookLinkTranslate(&$link) { $node = NULL; - // Access will already be set in the tree functions. - if (!isset($link['access'])) { - $node = $this->entityManager->getStorage('node')->load($link['nid']); - $link['access'] = $node && $node->access('view'); - } + // Check access via the api, since the query node_access tag doesn't + // check for unpublished nodes. + $node = $this->entityManager->getStorage('node')->load($link['nid']); + $link['access'] = $node && $node->access('view'); + // For performance, don't localize a link the user can't access. if ($link['access']) { // @todo - load the nodes en-mass rather than individually. diff --git a/core/modules/book/src/Tests/BookTest.php b/core/modules/book/src/Tests/BookTest.php index d094452..7f61892 100644 --- a/core/modules/book/src/Tests/BookTest.php +++ b/core/modules/book/src/Tests/BookTest.php @@ -449,6 +449,11 @@ function testBookNavigationBlock() { $nodes[0]->setPublished(FALSE); $nodes[0]->save(); + + // Verify the user does not have access to the unpublished node. + $this->assertFalse($nodes[0]->access('view', $this->webUser)); + + // Verify the unpublished book page does not appear in the navigation. $this->drupalLogin($this->webUser); $this->drupalGet($nodes[0]->urlInfo()); $this->assertResponse(403);