I'm not entirely sure if this is a bug or not. When I grant a user the "Administer content" permission, that user is able to delete any node using the update options on /admin/content, including nodes of content types for which they do not have any delete permissions (or any permissions at all, for that matter). I'm not sure if this is intentional because in the /admin/content view, the user does not see the "delete" link as an option in the Operations column for nodes of that content type, which would suggest that they should not be able to delete those nodes by any means. Similarly, if that user goes directly to /node/[nid]/edit, they get an access denied message (because they don't have edit privileges).
What I'm trying to do is give a content owner permissions to change the published and promoted statuses for some content types, but without giving them the ability to delete any and all nodes site-wide. It seems I can only give them publish/promote control by granting the "Administer content" permission, but as I noted, this seems to grant too much access. The expected behavior, I think, is that by granting "Administer content" permissions, that user can set published and promoted statuses, but is limited to operating on those content types which they have been granted add, edit, and/or delete permissions.
If everything is working as intended, feel free to close this ticket.
Comments
Comment #1
glacialheart commentedI am not sure if what you are describing is "working as intended" or not (hopefully someone else can answer that). But, it sounds like you need to create a new role for this user's specific set of permissions. That would be the easiest work-around for the moment.
Comment #2
knaffles commentedI'm not sure how to work around this. The problem I'm running into is that I have a user who needs to be able to change the published status of a particular content type. But in order for any user to change the published status of any content type, they need the "administer content" permission. And as soon as they get that permission, that user can delete any node. So I don't know how to work around it...but I might be missing something obvious.
Comment #3
bfroehle commentedThere are contributed modules which solve this problem. See, for example, Publish content.
Comment #4
knaffles commentedSince this seems to be the intended functionality, I'm closing this issue.