Problem/Motivation

When a node is set to private and unpublished, users are able to see the node.

Steps to reproduce

Create a node, set it to private and unpublished.
Then visit the site with a logged in user that has the permission granted to see private content.
The node will be visible.

Proposed resolution

Amend the condition that checks on the node status during node save.

CommentFileSizeAuthor
#2 3412285-unpublished-content-not-2.patch559 byteskiwimind

Comments

kiwimind created an issue. See original summary.

kiwimind’s picture

kiwimind commented
Status: Active » Needs review
StatusFileSize
new 3412285-unpublished-content-not-2.patch559 bytes

It seems that $node->status returns an object, so checking against its value seems to solve it.

kiwimind’s picture

kiwimind commented
Assigned: kiwimind » Unassigned
jbloomfield’s picture

jbloomfield commented
Status: Needs review » Reviewed & tested by the community

Paired up with kiwimind on this issue and can confirm it fixed the issue we were having. Marking as RTBC

drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Reviewed & tested by the community » Fixed

Publishing since this was resolved by https://www.drupal.org/sa-contrib-2024-012

Please report potential vulnerabilities confidentially in the future

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.