Since the property status of nodes is a core functionality, I think Grant should not override that. Grants should only apply if the content is published. At least for the view permission.
(Previously addressed in Drupal 7 version: #1444040: Access to unpublished node)
Create a node as not published.
Go to the Grants tab and choose all roles as "view". Specially if you give the Anonymous role access.
Go to view in an incognito window the node and you will have then permissions to see it.
Let core deal with unpublished content via the permissions.
| Comment | File | Size | Author |
|---|---|---|---|
| #19 | interdiff-3169490-14-19.diff.txt | 5.09 KB | szeidler |
| #19 | 3169490-19.patch | 6.42 KB | szeidler |
| #14 | interdiff_9-13.txt | 2.4 KB | abhijith s |
| #14 | 3169490-13.patch | 3.75 KB | abhijith s |
| #12 | 3169490-12-test-only.patch | 2.49 KB | abhijith s |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
eescribanoc commentedHere the patch, I also created a merge request.
Comment #4
alisonTitle tweak + related issues -- some of which might be slightly contradictory...? I'm not certain, but, for now just adding links.
@e.escribano - thank you for submitting!
Comment #5
jungleThis module does not take into account whether the node is published or not, currently.
So I'd suggest adding a settings item for this case -- add to nodeaccess/config/install/nodeaccess.settings.yml. For example: Bypass unpublished nodes, and defaults to FALSE, so that the existent sites won't be affected. Or the patch above is aggressive and destructive to me.
Tagging `Needs followup` for further discussion of if published and unpublished nodes should be distinguished.
Thanks!
Comment #6
yogisingh commentedComment #7
jungleI would move this to the latest dev branch 2.0.x which has schema added, tests added, an upgrade path provided and almost fully refactored etc.
Comment #8
jungleComment #9
eesquibel commentedI needed the nodeaccess module to honor the published status, so I wrote this patch against the latest 2.0-alpha1.
It didn't go the extra mile and add a UI to toggle the behavior, but at least this is one step closer.
Comment #10
jungle@e.escribano, Thanks for the patch, tagging "Needs tests"
Comment #11
peterbkk commented@e.escribano thanks, it resolved the issue for me.
Comment #12
abhijith s commentedAdding test case for patch #9. Please review.
Comment #14
abhijith s commentedComment #15
abhijith s commentedComment #16
markgp commented#9 resolved the issue for us.
Comment #17
ecvandenberg commentedPatch #14 seems to work fine here with multiple access modules and a complex structure of access rights and workflows.
Comment #18
mortona2k commentedThis patch works by preventing you from granting access to unpublished content, but it doesn't fix content that already has the grants.
It works by setting the view permission to the published status, when the grant form is saved.
There is no message to the user, the form silently unsets the value. If we keep this, I think there should be a message to the user about what's happening.
I think the fix should be done somewhere else though, like an access hook or event subscriber that would check when the content is loaded.
Comment #19
szeidlerThanks for your work on this. I also struggled with the same issue. In addition we have a use-case that we have translated content and the translations could have a different published status. A bit like described in #2469523: Add language support to node access grants. When using the patch as it is here the source language of a content would decide if the content is treated as published or unpublished and react wrong on the translations, if the status is different.
I added language capability to patch #14 and extended the tests. Please decide if that should go into this issue or handled separately. If not, then ongoing work should be based on #14.
Thanks for a review.
Comment #20
alyaj2a commentedHello, patch number 19 works for me. Thanks.
Comment #21
vbory commentedHello, both patches do not work. I am using content_moderation module for managing nodes status and have applied nodeaccess settings according to my needs, and in my case logged in user with non-admin role is able to view unpublished content. Maybe someone has faced with that, not just checking content for anonymous users? Thank you
Comment #22
tikaszvince commentedThe latest patch resolved this in my cases, when I tried with Drupal 10.2.7 and 10.3.1
Comment #23
doxigo commentedThanks everyone, applied the patch #19
Comment #26
guillaumeg commentedHi everyone, and thanks for the patch.
Could we please create a new release so that this important patch is included in the recommended module version?