Nodeaccess does restrictions works for viewing nodes, but not for edition or deletion for authenticated users.
It only works for anonymous users when the node is authored by anonymous (for example when author has been deleted and content assigned to anonymous).
This is a important feature as otherwise this module is not usable for many sites.
| Comment | File | Size | Author |
|---|---|---|---|
| #9 | nodeaccess-edit-delete-3039830-8b.patch | 3.62 KB | tikaszvince |
| #5 | nodeaccess-edit-delete-3039830-interdiff-3-5.txt | 829 bytes | gngn |
| #5 | nodeaccess-edit-delete-3039830-5.patch | 2.91 KB | gngn |
| #3 | nodeaccess-edit-delete-3039830-3.patch | 2.1 KB | ultimike |
| #2 | nodeaccess-3039830-2.patch | 2.44 KB | akalam |
Comments
Comment #2
akalam commentedComment #3
ultimike@akalam - nice work! You got me going in the right direction, but I couldn't get it working without a few more changes. Patch attached.
This patch, along with patches from #2985045: The settings do not respond to creating and deleting roles, #3033703: Syntax Error on SQL Queries , and #3034329: SQL Syntax & Condition error in _nodeaccess_get_grants($node) were necessary for me to get nodeaccess to properly restrict access during "update" and "delete" operations.
-mike
Comment #4
alisonThank you, @akalam and @ultimike! Sorry I haven't stopped by this issue thread yet, I'm putting it on my list for this week. (It would be suuuuuper wonderful if there could be tests with this functionality -- just throwing it out there!)
@ultimike, re: #3034329: SQL Syntax & Condition error in _nodeaccess_get_grants($node) -- are you still using that patch, and if so, could you please chime in over there with some more info? I just marked it "postponed/needs more info," but then saw your mention of it here.
...........
Thanks!
Comment #5
gngn commentedIn addition to the patch in #3 I also added two small changes in _nodeaccess_get_grants().
The two calls $db->select() used
$node->idinstead of$node->id()as condition for nodeaccess.nid.Because
$node->iddoes not return anything, this resulted in no results at all.So the function allways returned empty $grants and nodeaccess_node_access() returned AccessResult::neutral().
Patch and interdiff attached.
Comment #6
tikaszvince commentedHi,
I just rerolled the last patch to make it possible to apply on 8.x-1.1 version.
Comment #7
tikaszvince commentedHi,
update rerolled patch, to preven notice caused by missing username
Comment #8
tikaszvince commentedHi,
I've attached a new, updated patch, preventing PHP Notices caused missing roles from grant array.
Comment #9
tikaszvince commentedFix syntax
Comment #10
jungleHi there, could you work on the new 2.0.x branch which is the latest dev branch? Would be great to add a test to expose the requirement or the bug.