Problem

  • User gets an Access denied page after creating a node.

Goal

  • Redirect the user to a page she's able to access (e.g., the originating page).

Details

  • When creating a node that's unpublished (by default or via form submit handler adjustments), then you see an "Access denied" page after form submission.
  • Only happens if you don't have the "view unpublished nodes" permission. (only exists in D7+)
Files: 
CommentFileSizeAuthor
#29 node-form-redirect-1429442-29.patch2.26 KBmathankumarc
PASSED: [[SimpleTest]]: [MySQL] 40,012 pass(es).
[ View ]
#27 node-form-redirect-1429442-27.patch2.26 KBmathankumarc
PASSED: [[SimpleTest]]: [MySQL] 39,837 pass(es).
[ View ]
#24 node-form-redirect-1429442-24.patch2.3 KBdcam
FAILED: [[SimpleTest]]: [MySQL] Unable to apply patch node-form-redirect-1429442-24.patch. Unable to apply patch. See the log in the details link for more information.
[ View ]
#21 1429442-21.patch2.68 KBJody Lynn
PASSED: [[SimpleTest]]: [MySQL] 40,271 pass(es).
[ View ]
#19 1429442-19.patch2.56 KBnrambeck
PASSED: [[SimpleTest]]: [MySQL] 37,235 pass(es).
[ View ]
#15 1429442-15.patch2.49 KBJody Lynn
FAILED: [[SimpleTest]]: [MySQL] 37,082 pass(es), 1 fail(s), and 0 exception(s).
[ View ]
#13 1429442-12.patch2.48 KBJody Lynn
FAILED: [[SimpleTest]]: [MySQL] 36,710 pass(es), 3 fail(s), and 0 exception(s).
[ View ]
#10 1429442-10.patch2.33 KBJody Lynn
PASSED: [[SimpleTest]]: [MySQL] 36,627 pass(es).
[ View ]
#8 1429442-8.patch2.28 KBJody Lynn
FAILED: [[SimpleTest]]: [MySQL] 36,614 pass(es), 1 fail(s), and 0 exception(s).
[ View ]
#6 1429442-6.patch2.35 KBJody Lynn
FAILED: [[SimpleTest]]: [MySQL] 36,627 pass(es), 4 fail(s), and 0 exception(s).
[ View ]
#4 1429442-4.patch1.85 KBJody Lynn
FAILED: [[SimpleTest]]: [MySQL] 36,601 pass(es), 5 fail(s), and 1 exception(s).
[ View ]
#3 access_denied_redirect_1429442-3.patch928 bytesgnuget
FAILED: [[SimpleTest]]: [MySQL] 36,582 pass(es), 2 fail(s), and 0 exception(s).
[ View ]

Comments

sun’s picture

Issue tags:+Needs tests
Bojhan’s picture

Can we also have a msg, that informs the user what happens? I would be befuddled, if I am redirected - and unable to navigate to the page I just created. Something a long the lines of "You created *****, but you do not have sufficient permissions to view the unpublished ***"

gnuget’s picture

Status:Active» Needs work
StatusFileSize
new928 bytes
FAILED: [[SimpleTest]]: [MySQL] 36,582 pass(es), 2 fail(s), and 0 exception(s).
[ View ]

Hi.

I created a patch for this issue but i have a doubt, let's suppose to the user not have permissions to view their own content and be redirected to the edit page of that node, so, what happen if the user neither have permissions to edit their own content?, where suppose to be redirected?

I suppose to the user should be redirected to the page where he came from? if the answer is positive just let me know and i will change my patch.

For now i'm sure to my patch still needs work.

Jody Lynn’s picture

Status:Needs work» Needs review
StatusFileSize
new1.85 KB
FAILED: [[SimpleTest]]: [MySQL] 36,601 pass(es), 5 fail(s), and 1 exception(s).
[ View ]

This patch redirects users to is they don't have access to the node. That's the same thing that happens when they delete a node.

Status:Needs review» Needs work

The last submitted patch, 1429442-4.patch, failed testing.

Jody Lynn’s picture

Status:Needs work» Needs review
StatusFileSize
new2.35 KB
FAILED: [[SimpleTest]]: [MySQL] 36,627 pass(es), 4 fail(s), and 0 exception(s).
[ View ]

Status:Needs review» Needs work

The last submitted patch, 1429442-6.patch, failed testing.

Jody Lynn’s picture

Status:Needs work» Needs review
StatusFileSize
new2.28 KB
FAILED: [[SimpleTest]]: [MySQL] 36,614 pass(es), 1 fail(s), and 0 exception(s).
[ View ]

Status:Needs review» Needs work

The last submitted patch, 1429442-8.patch, failed testing.

Jody Lynn’s picture

Status:Needs work» Needs review
StatusFileSize
new2.33 KB
PASSED: [[SimpleTest]]: [MySQL] 36,627 pass(es).
[ View ]
tim.plunkett’s picture

Status:Needs review» Needs work
+++ b/core/modules/node/node.testundefined
@@ -573,6 +573,25 @@ class NodeCreationTestCase extends NodeWebTestCase {
+   * Create an unpublished node and confirm correct redirect behavior.

s/Create/Creates

+++ b/core/modules/node/node.testundefined
@@ -573,6 +573,25 @@ class NodeCreationTestCase extends NodeWebTestCase {
+    $langcode = LANGUAGE_NOT_SPECIFIED;
+    $edit["title"] = $this->randomName(8);
+    $edit["body[$langcode][0][value]"] = $this->randomName(16);

No real reason for a new langcode variable.

+++ b/core/modules/node/node.testundefined
@@ -573,6 +573,25 @@ class NodeCreationTestCase extends NodeWebTestCase {
+    $this->assertText(t('Welcome to Drupal'), t('The user is redirected to the home page.'));

The assertion success message shouldn't use t().

Jody Lynn’s picture

Status:Needs work» Needs review

I rerolled for the new test file structure.

@tim your first and third comments above aren't consistent with what's being done in the existing tests in NodeCreationTest.php so I didn't make those changes.

Jody Lynn’s picture

StatusFileSize
new2.48 KB
FAILED: [[SimpleTest]]: [MySQL] 36,710 pass(es), 3 fail(s), and 0 exception(s).
[ View ]

Status:Needs review» Needs work

The last submitted patch, 1429442-12.patch, failed testing.

Jody Lynn’s picture

Status:Needs work» Needs review
StatusFileSize
new2.49 KB
FAILED: [[SimpleTest]]: [MySQL] 37,082 pass(es), 1 fail(s), and 0 exception(s).
[ View ]

Can;t put a constant inside double quotes...

cosmicdreams’s picture

Status:Needs review» Reviewed & tested by the community
+++ b/core/modules/node/lib/Drupal/node/Tests/NodeCreationTest.php
@@ -86,4 +86,22 @@ class NodeCreationTest extends NodeTestBase {
+    variable_set('site_frontpage', 'node');
+

Just a note to myself and sun. If this patch is committed before #1496542: Convert site information to config system then we'll have to convert this new variable to the new config object.

Otherwise RTBC

sun’s picture

Status:Reviewed & tested by the community» Needs work
Issue tags:+needs backport to D6, +Usability, +Needs tests, +DrupalWTF, +needs backport to D7

The last submitted patch, 1429442-15.patch, failed testing.

nrambeck’s picture

Status:Needs work» Needs review
StatusFileSize
new2.56 KB
PASSED: [[SimpleTest]]: [MySQL] 37,235 pass(es).
[ View ]

I updated the patch so that the test uses the new config object to set the system front page as mentioned in comment #16

Cottser’s picture

Thanks @nrambeck, looks great.

+++ b/core/modules/node/lib/Drupal/node/Tests/NodeCreationTest.phpundefined
@@ -86,4 +86,23 @@ class NodeCreationTest extends NodeTestBase {
+    // Set the the font page to the default "node" page

This comment could be cleaned up a bit:
Set the front page to the default "node" page.

Leaving at needs review.

Jody Lynn’s picture

StatusFileSize
new2.68 KB
PASSED: [[SimpleTest]]: [MySQL] 40,271 pass(es).
[ View ]

I cleaned up nrambeck's comment and moved the redirect line to the new NodeFormController file.

marcingy’s picture

Status:Needs review» Reviewed & tested by the community
webchick’s picture

Version:8.x-dev» 7.x-dev
Status:Reviewed & tested by the community» Patch (to be ported)

This makes a lot of sense. Thanks for the test!

Committed and pushed to 8.x. Marking for D7 backport.

dcam’s picture

Status:Patch (to be ported)» Needs review
StatusFileSize
new2.3 KB
FAILED: [[SimpleTest]]: [MySQL] Unable to apply patch node-form-redirect-1429442-24.patch. Unable to apply patch. See the log in the details link for more information.
[ View ]

Backported #21 to 7.x.

sun’s picture

Status:Needs review» Needs work
Issue tags:+needs backport to D6, +Usability, +Needs tests, +DrupalWTF, +needs backport to D7

The last submitted patch, node-form-redirect-1429442-24.patch, failed testing.

mathankumarc’s picture

Status:Needs work» Needs review
StatusFileSize
new2.26 KB
PASSED: [[SimpleTest]]: [MySQL] 39,837 pass(es).
[ View ]

Re-roll

sun’s picture

Thanks! Only one very minor nit:

+++ b/modules/node/node.test
@@ -573,6 +573,25 @@ class NodeCreationTestCase extends DrupalWebTestCase {
+  ¶

Trailing white-space.

After adjusting that, we're RTBC here. :)

mathankumarc’s picture

StatusFileSize
new2.26 KB
PASSED: [[SimpleTest]]: [MySQL] 40,012 pass(es).
[ View ]

Removed the white space

sun’s picture

Status:Needs review» Reviewed & tested by the community

Thanks!

David_Rothstein’s picture

Status:Reviewed & tested by the community» Fixed
Issue tags:+7.22 release notes

Committed to 7.x - thanks! http://drupalcode.org/project/drupal.git/commit/5177237

I think there are times where the previous behavior might have been desired (e.g., depends on what you display on your site's access denied page), so I went ahead and mentioned this in CHANGELOG.txt. It's easy enough for someone to override it in their own submit handler if they need to.

Automatically closed -- issue fixed for 2 weeks with no activity.