Users with permission 'View any unpublished content' are not granted access to node if the node is yet to be published i.e. node->status = 1.

This happens if you are using revision on content type and don't publish a newly created node when saving it.
Example:
- You have one user that creates the content and another that shall approve them before publishing.
- The second user has permission 'View any unpublished content' but are not granted access to the content.
- The second user cannot publish the node because of access denied.

CommentFileSizeAuthor
#13 node_view_permissions_view_unpublished_content_2491419_13.patch1.17 KBlemuelsantos
#7 node_view_permissions-2491419-7-D7.patch881 byteszlatev
#5 node_view_permissions-2491419-3-D8.patch1.53 KBkiss.jozsef
#3 node_view_permissions-2491419-3-D7.patch2 KBIcePhenom

Comments

IcePhenom’s picture

IcePhenom commented
Issue summary: View changes

Bad comment

IcePhenom’s picture

IcePhenom commented
Issue summary: View changes

Bad comment

IcePhenom’s picture

IcePhenom commented
StatusFileSize
new node_view_permissions-2491419-3-D7.patch2 KB

This patch fixes this

IcePhenom’s picture

IcePhenom commented
Status: Active » Needs review
kiss.jozsef’s picture

kiss.jozsef commented
StatusFileSize
new node_view_permissions-2491419-3-D8.patch1.53 KB

Added 'view any unpublished ' . $type . ' content' permission so it works with view unpublished module

ben.bunk’s picture

ben.bunk commented

The patch in comment #5 worked for me in the D7 version.

zlatev’s picture

zlatev commented
StatusFileSize
new node_view_permissions-2491419-7-D7.patch881 bytes

I have created the same patch for workbench_moderation module. Maybe more general approach should be considered regarding this issues as all modules working with revisions will hit it.

adci_contributor’s picture

adci_contributor commented

Hi, guys!

Thanks for your big work.
Your patches partially correspond to the work of this module.
With any your patches I can get correct access to the node (published or unpublished) by direct link.
But if any node published on the front page, it doesn’t appear there.
I can’t add your patches to our code, but they can be used by someone if it fits they functionality.

adci_contributor’s picture

adci_contributor commented
Status: Needs review » Active
adci_contributor’s picture

adci_contributor commented

Hello everyone!
We solved this problem in another way. All the changes you can already see in the dev-branch.

adci_contributor’s picture

adci_contributor commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

lemuelsantos’s picture

lemuelsantos commented
Version: 7.x-1.5 » 8.x-1.x-dev
Priority: Normal » Major
StatusFileSize
new node_view_permissions_view_unpublished_content_2491419_13.patch1.17 KB

I believe this is still an issue for version 8.x-1.2 and 8.x-1.x-dev the approach to ignore unpublished node at hook_node_access_records has side effects on the admin/content view and generate conflicts with core and workbench module that for the "view own/any unpublished content" permissions.

The issue is because on hook_node_access_records unpublished nodes are skipped but hook_node_grants is ALSO called for unpublished nodes and there WON'T be any grants for unpublished nodes which results the unpublished nodes not appear in the admin/content if the users don't have the "bypass content access control". This will also happen in any other view that is not "disabling SQL rewriting" (disable node access checks).

I believe that approach must be reviewed in order to add grants for unpublished nodes and allow users with "view any unpublished content", "view own unpublished content" (workbench) or even "edit any [content type] content" permissions.

My workaround for now is adding a grant for "edit any [content type] content" and allow users with that permission view/update the node.

Please let me know your thoughts... thanks...