I have set my content type to "Always protected" and saved a password. However, access to the node using the password fails with "Incorrect password!" message.
This is because I do not have a global password set and I have "Global password handling" set to "per node password". The end user's entered password will never be validated because of the logic in protected_node_enterpassword_validate() in which only settings of PROTECTED_NODE_PER_NODE_AND_GLOBAL_PASSWORD and PROTECTED_NODE_GLOBAL_PASSWORD will check for per content type passwords.
Is this working as intended?
I find this to be very confusing since I can still enable my content type to be Always protected and save a password even though it does not do anything. Additionally I don't see this explained anywhere in the help text unless I'm missing it.
I do no want to set a global password.
I'm happy to work on a patch to fix this, but I wanted to check if this is in fact the desired behavior.
Comments
Comment #2
sheise commentedComment #3
grimreaperHello,
I have tested your case on a fresh Drupal install and I reproduce the behavior.
I understand that it can be confusing/frustrating.
I think the problem comes from the fact that on the protected node config page, you have to enter a global password if you select either "Per node password or Global password" or "Global password only".
Because "global password" can mean "a single global password" or "per node global password".
If you want to provide a patch feel free to do so. But it would require automated tests to be sure to not broke any existing features.
Also the easiest solution would be to set a global password very complicated generated randomly and not use it.
Comment #4
grimreaperHello,
In https://www.drupal.org/project/entity_access_password, this behavior is fixed.
Closing as there is no activity on this issue and D7 is EOL in november.