I have the permission "View all unpublished content" unchecked for anonymous users, and a node with a current moderation state of: Draft. However, anonymous users can still see this content when directly linked to it (they seem to be successfully hidden from views, which has one of the filter criteria as "Content: Published (Yes)").

What steps can I take to further explore this issue? Are there any content type specific settings that could cause this, or does it look like a bug?

Comments

anthony0perez’s picture

Issue summary: View changes

I have this same issue. Has no one addressed this problem? I find it hard to use this module as this was the purpose I thought. Hide to all anonymous users unless published. So your team can work on the page before going live. I am going to look at this a little more.

rooby’s picture

Category: Support request » Bug report
Priority: Normal » Critical

Seems like a serious bug to me.

Happy to change the priority back though if someone finds otherwise.

rooby’s picture

Are you using any add on modules like https://www.drupal.org/project/workbench_state_access

I have found that you can get this behavior if you misconfigure that module's permission.

StephenRobinson’s picture

me too, node_access returns TRUE for unpub content with anon user (not enabled in permissions)