if editing a node, node author changes to user editing it

Just a note that the OP fails to clarify that this is something that fails when a contrib module is in effect. This could well be a valid issue, but I have not been able to duplicate this in a clean core install - downgrading to normal.

-K

Having to edit the source to create a bug doesn't qualify as a critical bug. I say not only is it not critical, but if it's a contrib problem, file the report with the affected contribs.

FYI, book.module has its own permission item for creating book pages, which doesn't seem to clash with the administer nodes (e.g. having administer nodes permission doesn't let you create/edit book pages).

I understand that there may be different opinions as to whether this is critical or a bug at all (myself, I believe it is both) but marking it as 'won't fix' is a bit too drastic.

This issue makes it hard for contributed modules to offer useful functionality such as partial moderation without 'administer nodes' permission for all nodes. I don't see any reason for the current behavior, that's why it looks like a bug to me.

Ok, I believe this actually is a critical bug, as it breaks a Drupal feature. It's just a drupal feature that's a little hard to actually see, because core Drupal doesn't take advantage of it without an external module. In order to justify this stance, let me go back and define the scenario under which this causes problems.

If I am using a node_access based module--any node_access based module--and I give a user the right to edit a node that user does not own, but I do not give the user 'administer nodes' privileges, that user cannot effectively edit the node without taking ownership of it. It affects more than just the author, it also affects all flags such as revision, promoted to front page, sticky and moderated. Meaning if my user with editing privileges edits it, it may actually return to moderation if that's the default.

The problem is simply that this information is not preserved. In previous versions of Drupal, this was extremely difficult to preserve. [Note: Actually, after reading the code, it wasn't; node_save is smart enough to fill in missing information from the original node without doing any work at all, and all that had to be done was simply leave the information OUT.]

This patch ensures that all of the information is added to the node form via #type => value, meaning that it is never visible to the end user. This information is then simply passed through the form and written.

Adding this allowed the removal of a certain level of validation for non administrative users, since now we have guaranteed the required information will always be present.

To test this patch: You'll need to edit your code, or use any external module. The easiest one is node_privacy_by_role but if you happen to already have one set up in your test environment, great. If you don't have one set up and don't want the hassle that npbr will cause, try my node access arbitrator module.

In any case, to test the patch, give a non-administrative user permission to edit your node. Pre-patch, upon saving the node the node author and all node flags will revert to defaults. (As will the creation date). Post-patch: these values will be preserved. This patch should not affect other editing configurations, but obviously these should be tested to make sure.

Reduced a little code by using a loop in this version of the patch.

What a nice patch!

6 character edit on patch to remove erroneous 'date' field from the loop. 'created' supercedes it; 'date' is a string that is only translated back to a time if the user has administer node privs.

I am a bit confused by this patch. The code it removes does somethign based on the options set for the node type while the added code does not. Can somebody elaborate?

I am a bit confused by this patch. The code it removes does somethign based on the options set for the node type while the added code does not. Can somebody elaborate?

The code I removed forced all of the node options (promote, sticky, revision, etc) back to their defaults if anon-admin user was the one editing the node. With the new patch, those options remain where they were.

Yeah, that's what I thought. This means we change this behaviour. Not a good idea this late in the release cycle.

All right. I'm not happy about it, but here is a patch that only preserves the author and the creation time of the node.

applied

There was a considerable amount of discussion involved in chosing the workflow as it is now. I don't have a personal opinion on this, but I felt it btter not to mess with it now.