Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
If you allow anonymous users to create content on your site, you may want to allow them to edit their own content as well. Because there is a permission for doing so, "Edit own [content-type]", that you can click to give to the Anonymous role, you would assume that if you set that permission that the logic of that would work as expected: An individual anonymous user can edit their own node, presumably based on session.
You would probably not expect that Drupal considers all anonymous users to be a single user 0 and made no provisions for this setting so that by granting this permission you are allowing all anonymous users to edit each other's content (woops).
I propose there is a bug here in that the permission does not do what it says it will do.
Steps to reproduce
Proposed resolution
Add descriptions to the edit and delete own content for anonymous
Note that anonymous users with this permission are able to edit any content created by any anonymous user.
Note that anonymous users with this permission are able to delete any content created by any anonymous user.
Remaining tasks
Reroll patch
Review
Commit
User interface changes
Yes, additional text on permission page
TBA - add before and after screenshots
API changes
N/A
Data model changes
N/A
Release notes snippet
N/A
| Comment | File | Size | Author |
|---|---|---|---|
| #24 | reroll_diff_9-24.txt | 2.28 KB | ravi.shankar |
| #24 | 1198120-24.patch | 1.08 KB | ravi.shankar |
| #9 | 1198120.patch | 1.03 KB | jody lynn |
Comments
Comment #1
mdupontIndeed. There is no way to uniquely differentiate anonymous users (they are, well, anonymous) and Drupal tries not to create sessions for anonymous users. Users not familiar with Drupal will likely be confused and it can lead to a security risk. At least the checkbox could be disabled for anonymous user.
Comment #2
droplet commented"presumably based on session"
no, Im not.
Comment #3
mdupontI think this is a bug report rather than a task. While it may seem logical to an experienced Drupal user that anonymous users can't be distinguished from each other, it may not be obvious to newcomers and might lead to errors or even security issues.
To prevent that, at least a warning should figure on the permissions page about "own" permissions. Something like this in the header : "Warning: permissions applying to distinct users, such as Edit own content, should be carefully granted to the Anonymous user role. Anonymous users can't be distinguished from each other, therefore with such a permission any user which is not logged in will be able to act on content published by any other anonymous user".
Comment #4
bryancasler commentedI had a similar problem where a user could remove them self as the author, this was problematic because unknown to them this was associating the content with user 0 (ie the anonymous user). That then opened up a world of problems.
Comment #5
Bojhan commentedDoesn't need review
Comment #6
jody lynnI think we need to remove or disable the 'edit own x' permission checkboxes for anonymous users. Adding warning text around it just makes the page more wordy and may be ignored.
Comment #7
Everett Zufelt commentedAgreed that this could be confusing for some users, but there is a potential use-case (anonymous wiki, etc.). Can we just slap the standard "Security implication" warning on this and call it fixed?
Comment #8
jody lynnSo, the use-case is that you want anonymous users to be able to edit nodes created by other anonymous users but not created by authenticated users? I guess that can happen.
I think a security warning would be fine. Much less crazy than trying to remove or disable one checkbox on the page. (Reversed position :) )
Comment #9
jody lynnI added a description to the 'edit own' and 'delete own' permissions. I felt that adding 'restrict access' would be confusing as in general these are not permissions with security implications.
Comment #10
Everett Zufelt commented#9: 1198120.patch queued for re-testing.
Comment #23
quietone commentedTriaged during a BugSmash group triage meeting.
Mile23 noted that this issue is old enough to drive :-)
larowlan said that "the patch needs to propagate those changes to the node permissions class. But I think the solution is the best we can do."
edit: adding quotes
Comment #24
ravi.shankar commentedAdded reroll of patch #9 on Drupal 9.4.x. and removed needs reroll tag.
Comment #25
borisson_This change looks great, this is only adding a new string so no changes to any translations and since we are only adding a description I'm sure we don't need to add tests for this either. LGTM.
Comment #27
catchAgreed this is a good change, the 'anonymous user' concept doesn't exist everywhere so making it explicit with some help text, in the context of where it could cause a problem, is a good plan.
Committed/pushed to 10.1.x and cherry-picked back through to 9.5.x, thanks!