Problem/Motivation

It seems if you give access to anonymous, you also give access to unpublished view.

Proposed resolution

Prevent viewing node if unpublished.

Remaining tasks

User interface changes

API changes

Comments

trigdog’s picture

Hey @joelpittet,
I have been doing some testing with the dev of this module and wanted to make sure that this issue is fixed before moving forward with using it. I do not know a lot about node_access in Drupal but have been using this as a learning experience :)

I have tried a couple tests and it looks like if I sent a node to have anonymous users to have the view grant of a node through nodeaccess it works just fine for the published node and anonymous users can view it. When I unpublish the node I see that all records of that node in the node_access table are removed because of the following code in nodeaccess.module:

function nodeaccess_node_access_records($node) {
  if (nodeaccess_disabling() || !$node->status) {
    return NULL;
  }

After this, I get an "access denied" when trying to view the unpublished node from an anonymous user. If I am correct, if there are no records in the node_access table for the node then it will just use the user_access privileges for the node type.

Can you provide steps to reproduce? Maybe I can help debug :)

joelpittet’s picture

Sorry for the delay, I do need to provide some steps to reproduce.

All I can remember:

  1. Give Anonymous access on the grant tab of a basic page node
  2. unpublished a node.
  3. Visit the node as an anonymous user
  4. Saw that node's content in pink (default color background for unpublished pages).
  5. Freak out ;)
joelpittet’s picture

Yeah simpletest.me with just nodeaccess with the steps in #2

willzyx’s picture

@joelpittet this issue should be solved in #2228713: unpublished nodes are visible and commited in #2037899: Expose operations as API. Make sure to use the latest dev version of nodeaccess

joelpittet’s picture

Version: 7.x-1.x-dev » 7.x-1.4
Issue summary: View changes
StatusFileSize
new47.84 KB

@willzyx oh you are right, sorry I thought I was testing on -dev...

Leaving open just setting the version incase someone else runs into this.

A bit worried to upgrade because I got this message while testing the 7.x, after unpublishing and publishing a couple times.

I'll open a new issue for that.

joelpittet’s picture

This issue may be the fix for that one... #2427345: Database Error - nodeaccess_author duplicate entry Going to try it.

joelpittet’s picture

Status: Active » Fixed

Closing to keep your queue clean:)

Also ran into an related issue with unpublished nodes that I'll see if I can create a test case for.

joelpittet’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.