Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Problem/Motivation
When user saves node then Drupal should check if user has access to it and then decide if the new node title in the message should be link or not.
Message with link
User doesn't have access to it
To recreate:
- Drupal 8.x-4.x installation
- Create a new user role
- Add a new user and give the user the newly created role
- Give the user permissions to create/edit the page node type
- Don't give the user the 'View published content' permission
- Login as the user and create a new content of the type page
- Notice that you get a success message with a link to the node while you are in the access denied page for that node.
Proposed resolution
Add a node access check.
| Comment | File | Size | Author |
|---|---|---|---|
| #24 | links_without_access-2866619-24.patch | 1.67 KB | vakulrai |
| #22 | 2866619-22.patch | 811 bytes | nikitagupta |
| #19 | 2866619-19.patch | 799 bytes | ranjith_kumar_k_u |
| #3 | remove-link-to-node-if-not-access_2866619_3.patch | 789 bytes | shabana.navas |
| Screen Shot 2017-04-04 at 13.05.35.png | 8.47 KB | hkirsman | |
Comments
Comment #2
hkirsman CreditAttribution: hkirsman commentedComment #3
shabana.navas CreditAttribution: shabana.navas at Acro Commerce commentedAdded node access check before outputting the node title as a link in the success message so that we're only displaying the link if the user has view access on node insert and update.
Comment #4
bander2 CreditAttribution: bander2 as a volunteer commentedI can reproduce this on 8.4.x because of this issue:
#1368610: It is confusing why creating a node requires users to have permission to "view published content"
Comment #5
bander2 CreditAttribution: bander2 as a volunteer commented*can't not can
Comment #6
hkirsman CreditAttribution: hkirsman commentedThank you @shabana.navas! #3 works!
Not sure how is #1368610 related? Also I was not able to find the code that the patch tries to fix at https://www.drupal.org/node/1368610#comment-10607206 Using 8.3.2
Comment #7
bander2 CreditAttribution: bander2 as a volunteer commented#1368610 keeps me from reproducing the issue because:
I'm not sure how to proceed. I am new to performing reviews. I don't want to give this RTBC unless I can reproduce the issue and confirm that the patch fixes it. I'm not sure if it is appropriate to fix #1368610 locally so I can reproduce this bug to move it along?
Comment #8
achandna CreditAttribution: achandna commentedCan not reproduce this bug as per #7 and we get "access denied" if "View publish" permissions are not given.
If these permissions are required to create/edit a content. This issue won't get reproduced.
Comment #9
karan_kural CreditAttribution: karan_kural commented.
Comment #10
hkirsman CreditAttribution: hkirsman commented@achandna, this was not about the #7 but what was talked in the initial issue and what shabana.navas fixed in #3.
Comment #11
hkirsman CreditAttribution: hkirsman commentedComment #19
ranjith_kumar_k_u CreditAttribution: ranjith_kumar_k_u at Zyxware Technologies commentedRe-rolled for 9.2
Comment #22
nikitagupta CreditAttribution: nikitagupta at Srijan | A Material+ Company for Drupal India Association commentedworked on test failure.
Comment #24
vakulrai CreditAttribution: vakulrai as a volunteer and at QED42 for QED42 commentedUpdating the failed tests for the logic implemented.
Comment #26
Meenakshi_j CreditAttribution: Meenakshi_j at Srijan | A Material+ Company for Drupal India Association commentedHello,
I am not able to reproduce the issue based on the steps given in the issue summary.
This I believe is because the summary relates to the older 8.x version which definitely needs an update so tagging for issue summary update.
Comment #27
hkirsman CreditAttribution: hkirsman commentedTx all!
I think it might have been fixed because you can't create node without "View published content" thus you can't see the message. I tested it with 8.9.16
Comment #30
quietone CreditAttribution: quietone commentedI agree with #4, #7, #26, and #27 that this is not reproducible. I tested this on 9.4.x and was not able to reproduce this error. I followed the steps given in the Issue Summary.
Therefore, closing as cannot reproduce. If you are experiencing this problem on a supported version of Drupal reopen the issue, by setting the status to 'Active', and provide complete steps to reproduce the issue (starting from "Install Drupal core").
Thanks!
Comment #31
Dubs CreditAttribution: Dubs commentedHi all,
I'm reopening the issue because there are valid use cases, for example, in the case of content moderation an anonymous or authenticated user could create some content and then not have permissions to view the content. The above patch works in this situation.
Logically, a link to view unpublished or draft content should not be provided as this will result in an access denied page for the visitor.
Thanks for reading, and hopefully this patch can find it's way into the code base.
Comment #32
smustgrave CreditAttribution: smustgrave at Mobomo commentedPer #30 if this is going to be reopened steps to reproduce fully need to be included in issue summary.