I have a solid use-case where editors need to be able to add references to unpublished content. They will schedule both the referencing items and the referenced item for publication, and these must not be publicly discoverable until the scheduled time.
Entityreference adds a generic "node_access" tag to the query, but the resulting access check does not appear to respect the "view own unpublished content" permission. I guess the query running over ajax results in the user being anonymous at the server?
It doesn't seem possible to remove the node_access tag via hook_query_alter().
I can hack the node_access tag out as a temporary solution, but that's a potential problem waiting to bite me. Does anyone have any suggestions for a cleaner way to implement this?
Comment | File | Size | Author |
---|---|---|---|
#13 | 1451852-entityreference-validateunpublished-13.patch | 1.59 KB | dafeder |
#11 | entityreference_validate_unpublished.patch | 1.29 KB | bsandor |
#3 | 1451852-entityreference-validateunpublished-3.patch | 1.79 KB | j0rd |
Comments
Comment #1
FiNeX CreditAttribution: FiNeX commentedDuplicate of http://drupal.org/node/1504054
Comment #2
j0rd CreditAttribution: j0rd commentedRe-opening this, as author does a good job of explaining a typical use case, and it's not really a duplicate, since the solution in the other thread says to change the view or enable "bypass node access".
For me, I'm not using views, so that's not a solution. And 'bypass node access' has a lot of un-intended consequences as it's used in other contrib modules that permission for important things.
Here's a very simple use case on an end user site.
With out fixing the problem , as more descriptive error message helping users to resolve their own problems might mostly avoid this.
Something like: "[node:type] [node:title] is no longer available. Please remove it before saving your content."
Ideally we'd have the option in the field settings to avoid this check all together:
[x] Allow unpublished nodes to show up in auto complete
[x] Allow unpublished nodes to be saved
[x] Remove unpublished nodes from parent, upon editing parent (i've done this for deleted nodes on my site already to resolve another problem)
[x] Allow own unpublished nodes to be show and saved in auto complete.
Comment #3
j0rd CreditAttribution: j0rd commentedHere's a sample hack^H^H^H^H patch which provides an example of how this could get done. The field settings are fully available in query's metadata, so the field settings could easily get extended to allow for more fine grained control.
Comment #4
duckydan CreditAttribution: duckydan commentedThe patch in #3 worked perfectly for me. I was not able to find another way that was compatible with entityreference_prepopulate.
Comment #5
Ayrmax CreditAttribution: Ayrmax commentedI made a module some time ago. It adds a new selection handler to the entityreference field. This handler enables an author with the "Reference unpublished node" permission to reference to unpublished nodes without the need of the "administer content" permission or node access module.
https://drupal.org/sandbox/Ayrmax/1977458
I used it in multiple projects without any issues.
Comment #6
CMStom CreditAttribution: CMStom commentedI also have run into this issue where I can't reference unpublished content. I went ahead and enabled "Bypass content access control". I'll give Ayrmax's module a try.
Comment #7
hadsie CreditAttribution: hadsie commentedThanks @Amyrax. Your reference module works for me and the code is pretty straight forward. Is there any reason that this shouldn't be incorporated into the Entity reference module? Perhaps it's too specific to nodes?
Comment #8
bsandor CreditAttribution: bsandor commentedThis is a serious issue here.
Why would a module limit me referencing unpublished modules???
My use case is that users can prepare nodes before publishing it and referencing those nodes from other attached nodes while nothing is published until original node becomes published.
I am stucked. I am thinking of going back to normal select box instead of using this module as of this male function / bug here.
This needs to be fixed for sure.
SOLUTION:
I am thinking of:
Changing this issue to 'Mayor'.
Comment #9
bsandor CreditAttribution: bsandor commentedComment #10
bsandor CreditAttribution: bsandor commentedComment #11
bsandor CreditAttribution: bsandor commentedI have modified @J0rd 's patch just to have a more elegant way. No mayor differences.
This patch works great for me.
Comment #12
dafederActually #3 is the properly formatted patch :)
Comment #13
dafederI take it back, neither is quite right. Here is a proper patch using @basndor's code.
Comment #14
psychobyte CreditAttribution: psychobyte commentedany plans for the solution proposed in #8 to get into core module?
Comment #15
Poindexterous CreditAttribution: Poindexterous commentedThis is a problem for me also. We (the team I work with) will be testing out this patch shortly. Our use-case involves a content moderation configuration where "content entry" staff roles may only create content as a draft (unpublished node status), which eventually get passed on to an editorial department for approval (published node status). Entity reference fields are common in our content types (we have things like speakers, teachers and location content types that need to be referenced by other node types like events, classes, etc). It would cause havoc for us to give content entry personnel the "bypass all" permission, we reserve that for editorial and admins for good reason. We need to limit permissions in a strict manner to make sure unauthorized content doesn't go live. Entity reference and content moderation modules (where users create unpublished "drafts") are so frequently used in tandem I suspect this may be a more common problem than reflected here.
Comment #16
joel_osc CreditAttribution: joel_osc commentedPatch worked great for me too, would be good to get this functionality in. Cheers.
Comment #17
tyler.frankenstein CreditAttribution: tyler.frankenstein commented#13 had no effect for me with either Simple selection or Views selection mode. Using xdebug I can only see this patch being ran when Views selection mode is enabled, but not when Simple selection is enabled. However, after removing this patch I'm still able to use Views selection mode and configure the View's filters to show unpublished nodes. So for me, this patch has no effect, I like the direction it is going though...
Comment #18
tyler.frankenstein CreditAttribution: tyler.frankenstein commentedTo follow up, Views selection mode (with a filter allowing unpublished nodes) is a way around this when using the node edit form. But when programmatically updating a node, it still doesn't retain references to unpublished nodes.
Applying the patch in #13 does allow me to programmatically update a node that references an unpublished node, but the issue still stands that when using the node edit form, the patch doesn't allow me to reference unpublished nodes.
Comment #19
tyler.frankenstein CreditAttribution: tyler.frankenstein commentedComment #20
Charles BelovSo far, the assumption seems to be that this behavior always happen. That's not necessarily the case. I can think of instances where some staff would need it and other staff might find it confusing. As of the latest patch, it appears that everyone gets this behavior whether it's appropriate for them or not.
I strongly suggest, at the very least, that unpublished entities showing up in the autofill need some sort of distinction to explicitly indicate that they are unpublished versions.
For instance:
On our current website, which also implements Workbench Moderation and adds an Archived (formerly published) revision state, Archived pages with the same names as published pages already turn up in Entity Reference autofills. I have had complaints from staff that this is confusing to them as, if two pages, one published and one archived, have the same title, it's hard to pick the correct (published) one.
That said, it needs to be considered whether this feature needs to have a configuration checkbox to enable or disable it.
Comment #21
kbasarab CreditAttribution: kbasarab commentedPatch #13 worked great for my use case as well. We have a custom widget built on type of entity reference fields that required referencing unpublished content. This patch has a tag for users to override if wanted but otherwise allows access without allowing bypass node access.
Comment #22
NancyDruIn my case, we are using ER for a taxonomy term. The node is new and unpublished. The link does not get created and we see
The referenced entity (node: 1798) is invalid.
in the log. This patch does not seem to fix this issue.Comment #23
AdamPS CreditAttribution: AdamPS commentedI also came looking for a way to allow a reference to unpublished content, so this issue is useful. However I would say the patch here is not suitable for commit.
I don't see that all sites want to allow references to be made to unpublished content. If node A is published and refers to node B that is not published, this could break the display of node A. So I would say that the existing behaviour is completely valid, and to change it may break existing sites.
Hence this seems to be a feature request "provide an option to allow references to unpublished content". How might this work?
So this seems to be a request for a feature that already exists in a couple of reasonable ways.
Some more specific comments on the patch. These should be resolved if adding this code as an option to the simple widget.
Comment #24
John Pitcairn CreditAttribution: John Pitcairn commented@AdamPS: Agreed. Using a view without a "published" filter solves the problem, and that's what I have been using (sorry, I should have followed-up).
Comment #25
nicrodgersChanging status back to needs work, as the comment in #23 doesn't address tyler.frankenstein's comment in #18 about not being able to programatically edit an unpublished node.
Comment #26
AdamPS CreditAttribution: AdamPS commented@nicrodgers I think what you are doing is termed issue-hijacking:-)
The OP has agreed with the resolution I posted for his issue.
It's often the case that related matters arise in the discussion in comments. As I understand it, the consensus in the community is to raise a new issue in the case where the related issue no longer has the same status as the original.
Comment #27
AdamPS CreditAttribution: AdamPS commentedNo reply from @nicrodgers, so closing this one again. The OP has agreed the problem is solved. Please open any related but different issue separately.
Comment #28
tyler.frankenstein CreditAttribution: tyler.frankenstein commentedComment #30
yonailo CreditAttribution: yonailo commentedHello,
I do not understand why this issue has been closed. After the update of workbench_moderation module to version 1.4, there is no more hook_node_grants() and therefore I am not able to reference an unpublished node. This is important for workbench_moderation as it is commonly used to compose a complex page with a lot of references without publishing the referenced nodes until the complex page/content is ready.
A solution should be provided, I dont know if entity_reference is the right thing to hack or if we should go through a hook_query_alter() to modify the original query...
Moreover, I doubt that an entityreference patch is needed. Any module can implement hook_query_TAG_alter() with TAG = node_access to remove the query condition which adds NODE_PUBLISHED
Comment #31
Dubs CreditAttribution: Dubs as a volunteer and at Drupology commentedSo this comment isn't strictly related to how this thread is progressing but will hopefully help similar configurations to mine.
In my case this error was due to the autocomplete values coming from a view. The view had a node:published filter. Removing this (or changing it to published or admin) fixed for me.
Comment #32
geerlingguy CreditAttribution: geerlingguy at Acquia commentedFor Drupal 8, at least... see https://www.drupal.org/project/entity_reference_unpublished