Problem/Motivation

When I enable the module, and users are denied access to a node type I do not expect them to see the nodes.

Instead, anonymous users can see title and teaser at /node but if I click on a title I get a 403 (e.g. no node/2).

Proposed resolution

The module should be very clear that it doesn't work to hide content in Views, etc

Or it should implement a proper node access API

Remaining tasks

Comments

pwolanin created an issue. See original summary.

orbistertius’s picture

I had the same problem with the root-user (user 1) so I needed to uninstall this module. Perhaps I missed something when I set up the module... but I recommend to exclude the user 1 from permission restrictions!

pryrios’s picture

Views has never respected permissions, but rather grants. This has been always to avoid calling the access functions on big node lists because it causes performance issues.

If this does not bother you, you can add the tag "node_access" to your view and this should consider access permissions for node display, but at a significant cost when loading your view. This is done in the advanced configuration of the views, under Query Settings on the Query tags field.

This module states that it simply adds permissions for managing content access, so implicitly is stating that it does not work out of the box with views, but maybe it would be a good idea to add such a comment on the documentation.

el1_1el’s picture

i have a suggestion for this and other issues - https://www.drupal.org/node/2895633

adci_contributor’s picture

Hi, guys!

Thanks for this issue. Really, this module should completely hide all selected content. We will try to fix it in the next update.

yas’s picture

@adci_contributor

Just let you know that I tested el1_1el's patch at https://www.drupal.org/node/2895633.

adci_contributor’s picture

Hi, @yas!

Thank you for this information. We added this patch to the new release.
Please check and test it.

Best regards.

adci_contributor’s picture

Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.