That's my use case: Users add blog posts and articles as drafts. Users edit their posts and set them to Needs Review. Editors review posts and publish them.
I have problems with first phase.
Users absolutely need premission "View own unpublished content". If user have permissions "moderate from draft to needs review" and "view revisions" they can see moderation tab on any blog post. If they have no "view revisions" permission they see "403 access denied" error on /node/%/current-revision.

CommentFileSizeAuthor
#4 access-denied-after-edit-1397824-4.patch537 bytesdarrenmothersele
#1 workbench_moderation-1397824-access_current_revision.patch1.67 KBfasdalf@fasdalf.ru

Comments

fasdalf@fasdalf.ru’s picture

fasdalf@fasdalf.ru commented
StatusFileSize
new workbench_moderation-1397824-access_current_revision.patch1.67 KB

Added access callback to show draft of unpublished node to users with "View own unpublished content" but with no "Vew Revisions" permissions. Works well for me. Test it please.

fasdalf@fasdalf.ru’s picture

fasdalf@fasdalf.ru commented
Status: Active » Needs review

up

fasdalf@fasdalf.ru’s picture

fasdalf@fasdalf.ru commented

/node/%node/view and /node/%node/draft both have their own access check, so 'access arguments' => array('view revisions'), Is overkill.

  // View the current revision of a node. Redirects to node/%node if the current revision is
  // published, and to node/%node/draft if the current revision is a draft.
  $items["node/%node/current-revision"] = array(
    'page callback' => 'workbench_moderation_node_current_view',
    'page arguments' => array(1),
    'access arguments' => array('access content'),
    'file' => 'workbench_moderation.node.inc',
  );

I think "access content" is enough.

darrenmothersele’s picture

darrenmothersele commented
StatusFileSize
new access-denied-after-edit-1397824-4.patch537 bytes

I found 'access content' is enough. Patch for 1.x

burgs’s picture

burgs commented
Status: Needs review » Reviewed & tested by the community

The patch in #4 seems to work correctly. People who should see the content, can see it, and people who shouldn't can't (whether they have access content permissions or not). It is redirecting to the main node view page always for me. I'm presuming this is standard behaviour for this url.

mwallenberg’s picture

mwallenberg commented

#4 works for me too.

antiorario’s picture

antiorario commented

I think it's time to commit this one.

Also: remember to clear the cache after applying the patch.

les lim’s picture

les lim
he/they
Primary language English
commented
Version: 7.x-1.1 » 7.x-1.x-dev

Changing version.

stevector’s picture

stevector
he/him
commented
Status: Reviewed & tested by the community » Fixed

Thank you. I've committed #4

http://drupalcode.org/project/workbench_moderation.git/commit/0cd33781e2...

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

mthomas’s picture

mthomas commented
Issue summary: View changes
Status: Closed (fixed) » Needs review

I think patch #1 should be committed also. If a user has permission to view their own unpublished content, it seems like they should also be able to review a draft they created. Is this not the case?

mthomas’s picture

mthomas commented
Status: Needs review » Closed (fixed)

After reviewing this a bit more, I think my issue is separate. Closing with apologies.