Hi,
I have installed Workbench yesterday to try it out, very impressive piece of software. While using it, I came across a problem, or at least I think it is a problem. Before I open a case, I wanted to check with you that it was really a problem in the first place.
The way I've set my environment is that I have contributors who are the people who can create content to be published on my site, and editors who will review articles, pages, etc to be published.. I made sure to give all the correct access , View all unpublished content and set MY DRAFTS and NEEDS REVIEWS to allowed by both. Now for some reason, if I do not give this the following access right to CONTRIBUTOR (role) Bypass content access control, contributors will NEVER SEE their publications in MY DRAFTS.
Now, if we look at the note below 'Bypass content access control' :
"View, edit and delete all content regardless of permission restrictions. Warning: Give to trusted roles only; this permission has security implications", I felt very uneasy to give that access but it seemed to be the only way to fix the problem or perhaps there is something I am not doing ? I made sure that for the content types that I wanted to be used with WORKBENCH have been set with 'Enforce Workbench Access control' and enabled MODERATION OF REVISIONS..
Any idea?
Comments
Comment #1
vchen CreditAttribution: vchen commentedDid you create any content that went through the moderation workflow?
My Drafts tab filters for those nodes that has a moderation status attached to it.
Comment #2
ditcheva CreditAttribution: ditcheva commentedI am experiencing the same issue. I've used Workbench and Workbench moderation for over a year, so I definitely can tell something is wrong. Only after upgrading to 1.2 did I start having issues with the 'My Drafts' and 'Needs Review' views not displaying nodes for folks unless I give them 'Bypass content access control'... I have tried different versions of Views, Workbench and Workbench Moderation to figure out where the problem lies, and only reverting back to version 1.1 of Workbench solves my issue.
One additional note: in the 'Needs Review' view that is also broken, it seems that edited nodes (ones that already have revisions, but are being modified) do show up in the view. However, brand new nodes do not.... again, unless I give the 'bypass content access control' permission (which, like you say, is a poor work-around, as you'd have to give it to all editors). Perhaps that may add a bit of clarity to the problem. It seems it may be an issue with both permissions and these being *new* nodes?
Comment #3
ditcheva CreditAttribution: ditcheva commentedCorrection. I spoke too soon. It actually seems like I have to use the older 1.2 version of Workbench moderation and Views 3.3 to be able to use the 'My drafts' and 'Needs Review' views properly (without needing the 'Bypass content access control' permission...
Comment #4
ditcheva CreditAttribution: ditcheva commentedI figured out my issue! I was using another node permissions module (Node access user reference) that somehow started interfering with the updated versions of views, workbench and workbench_moderation.
After I disable that module, the 'Needs review' and 'My drafts' pages actually work well. Since your problem also seems to be solved by elevating permissions, it's possible that you also have an interfering node access module, even if it isn't exactly the way I use.
You could either disable that or roll back to Views 3.3, Workbench 1.1 and Workbench Moderation 1.2, which didn't seem to have these incompatibilities.
Just wanted to update everyone with this new finding!!!
Comment #5
krystalcode CreditAttribution: krystalcode commentedI have the same issue here, which happens when I use nodeaccess_userreference. Thanks @ditcheva for the hint, it works when I revert to the versions that you mentioned.
Versions that I am using when the problem occurs are:
views-7.x-3.5
workbench-7.x-1.2
workbench_moderation-7.x-1.3
Comment #6
duncan246 CreditAttribution: duncan246 commentedSlightly different experience, but using same views and workbench modules as in #5.
Not using any node access modules other than Workbench, so there was nothing obvious I could switch off.
Decided to test by switching off all modules except core and building them up again. Enabled Wb Mod 1.2, Views 3.3 and Wb 1.1 (as recommended in #4) and -- yes -- it works.
But as soon as I enabled Workbench Access 1.2 then the problem appeared again. Tried Wb Ac 1.1 -- still no joy. Tried Wb Ac 1.0 -- and we're working again.
So the winning combo for me was:
Comment #7
asunko CreditAttribution: asunko commentedI have the same problem.
Versions that I am using when the problem occurs are:
Views 7.x-3.5
Content Access 7.x-1.2-beta1
Workbench 7.x-1.1
Workbench 7.x-1.1
Workbench Access 7.x-1.2
Workbench Moderation 7.x-1.3
I found out that this problem occurs when the views version 3.5 is used with the module Content Access.
If we return views back to version 3.3, the drafts will be displayed for users who don't have 'Bypass content access control' permission. After clarifying the difference in database queries between views 3.3 and views 3.5, I found that for a user who does not have 'Bypass content access control' permission, the condition of the existence of nids in the table node_access is added to the query which is formed by views to display drafts.
the condition that is added:
AND ( EXISTS (SELECT na.nid AS nid
FROM
{node_access} na
WHERE (( (na.gid = 0) AND (na.realm = 'all') )....
In this case, My Workbench draft views returns an empty result, because if a node was never published, there is no record for it in the table node access. I tried to remove the 'node access' tag from the query in hook_query_alter but I could not remove it: it was still added to the query.
I was able to solve this problem by installing module view_unpublished http://drupal.org/project/view_unpublished. In that case you need to add to your role permission "view any unpublished content" or if you need to limit access by particular content type - "view any unpublished (name of content type) content" permission. These permissions are provided by view_unpublished module.
Comment #8
gaborpeter CreditAttribution: gaborpeter commentedI have a very similar setup.
When I disabled the SQL rewriting in views, issue was gone, so it is clear the content_access module is causing this issue.
I confirm #7.
The problem comes from content_access not adding and grants to the node_access table before the content is unpublished.
The module view_unpublished solved my problem too.
Probably we could add access support to workbench based on view_unpublished?
Comment #9
ikaros123 CreditAttribution: ikaros123 commentedI have the same problem
Workbench 7.x-1.2
Workbench Moderation 7.x-1.3
Views 3.5
OG 7.x-2.2
and I am also using Organic Groups, but I am not using the OG Workbench integration module ...
I have to grant my editor role the "Bypass content access control" permission to be able to see the drafts/needs review page. (all other permissions are set correctly as I check in the Workbench configuration"Check Permissions" option) .
I don't think I shouls install View unpublished module (https://drupal.org/project/view_unpublished) cause it may alter my OG permissions ...
Is there any other way to overcome this ?
Comment #10
ikaros123 CreditAttribution: ikaros123 commentedso I installed the view_unpublished module after all... now I don't have to grant the bypass content access control permission and the drafts page works for each user now
Comment #12
sunnydeveloper CreditAttribution: sunnydeveloper commentedview_unpublished only seems to allow the option to view unpublished content - but not just 'own unpublished content', yes this worked, but now my user sees ALL unpublished content of the given content type, not just their own.
Comment #13
MrPaulDriver CreditAttribution: MrPaulDriver commentedHaving read through the above I still don't know whether this is a bug or a feature!
Only to say that if users are not able to view their own unpublished content, then this is completely at odds with the notion of a workbench. What is the point of a workbench where you cannot find your work?
The view_unpublished module helps to overcome the problem, but we really shouldn't need this as the existing permission of 'view own unpublished content' ought to be sufficient. The alternative method of allowing users to 'Bypass content access control' will in most cases be undesirable too.
I hope nobody minds me renaming this issue and recategorising as a feature request. Maybe it even needs flagging as a bug?
Comment #14
aubjr_drupal CreditAttribution: aubjr_drupal commented#7 worked for me as well for getting "My Workbench" to show all unpublished content to roles that don't have full access.
NOTE: It only worked after I rebuilt permissions at /admin/reports/status/rebuild. (This was also obviously after I had installed and enabled the View Unpublished module and checked the "View All Unpublished Content" permission for the non-admin roles. This may also work with the more granular View Unpub. per content type permissions but I didn't try that.)
Comment #15
rliAgree with #13.
We should not use the view_unpublished module as we already have 'view own unpublished content permission.
Also we need to keep node_access rewrite on in the view setting. I see this is a bug as view is overriding the system permission.
Comment #16
thedavidmeister CreditAttribution: thedavidmeister commentedWorked for me, and I don't think it causes any new trouble for my setup (similar or identical to the OP).
It's a bit of a hack, but I'm using tac_lite, so I'll have to deal with it.
Comment #17
thedavidmeister CreditAttribution: thedavidmeister commentedFWIW, this should do the trick for anyone who wants to just force off the rewrite for this view:
Comment #18
rrafferty CreditAttribution: rrafferty commentedAdding the view_unpublished module will fix the issue. Be sure to rebuild permissions after installation: /admin/reports/status/rebuild
Comment #19
colanSee #1492118: View all unpublished content permission not working.