The status of current unpublished revision is '1' which should be '0'.

This issue would cause the node-unpublished class missing from the node page.

It also would bring a potential security issue if any other modules relies on the status flag of an unpublished revision which is incorrectly set to published (1).

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Mingsong created an issue. See original summary.

Mingsong’s picture

Issue summary: View changes

The patch #3 would fix this issue.

Mingsong’s picture

jbaum_13’s picture

Thank you @Mingsong, your patch worked! The draft version on the node is again showing the node-unpublished class with the workbench_moderation 7.x-3.0 and the dependent drafty module. I greatly appreciate your help!!!

Mingsong’s picture

Hi @jlandbaum,

Thank you for your feedback.

Cheers,

Siavash’s picture

Status: Active » Needs work

Hi Mingsong,

Thanks for this patch, at first glance it seems like it's doing the job but it's not considering the scenario where we are editing an unpublished draft and leaving it unpublished while a published revision already exists. In this case, the published revision is getting unpublished.

Looking into this myself while familiarizing myself with the new workbench moderation 3.x code.

Thanks,
Sia

Mingsong’s picture

Hi Sia,

I tested the patch at #3 for the situation you mentioned where there is a existing published revision and a draft revision for a node.

The patch worked as expected that the published revision remain published and the draft version shows up with node-unpublished class.

See the attached screenshot from my testing.

Mingsong’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 3: 2872232-3.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

Siavash’s picture

Hi Mingsong,

I just tested this on another site with a fresh copy of workbench_moderation 3.x and drafty. In your case, the draft is the latest revision. You must be using some kind other patch on workbench 3.x (Or are you using dev version?) that allows you to have a draft with a higher revision ID than the published draft. In the current release of workbench 3.x, it always copies the current published version as the latest revision even when we have a draft revision going.

I'm going to test with the dev version.

Thanks,
Sia

Siavash’s picture

I'm experiencing the same issue with dev version of workbench moderation 3.x. I'm not using the patch that deletes the newly created revision since I'm taking action on newly created revisions and I don't want them to be deleted. So each time I edit a content, currently 2 new revisions are being created. 1: The newly edited draft as a draft 2: a copy of the published revision. I believe this new workflow (as inefficient as it seems) was created to counteract a security issue with workbench which we are trying to solve for.

It seems like you might have to save the draft twice for this issue to occur, sometimes the first time it doesn't trigger. (It might have been a cached thing because following that it happens every time.)

Mingsong’s picture

Hi Sia,

Thanks for your prompt response.

Yes, you are right. I can reproduce the issue you mentioned above with a fresh installation.

Since the new version of Workbench moderation relies on Drafty module to deal with draft revision copies, I think this issue might need to fix by the Drafty module.

Siavash’s picture

I was able to resolve this issue along with node unpublishing issue upon draft edit here: https://www.drupal.org/node/2824725#comment-12250562

Siavash’s picture

==deleted== posted in the wrong thread

Mingsong’s picture

Finally, I have a chance to make progress for this issue.

Basically, this issue is related to the security issue affected to Workbench Moderation versions prior to 7.x-3.0.

To fix it, the Drafty module that Workbench Moderation relies on has to create a new published revision for a published node once there is a new draft revision is created.

In this way, Drafty module can ensure the most recent revision is the published one.

Why we have do that?

See this post for the explanation.

The workaround is to update the status of a draft revision after saving an entity and the moderation draft flag before saving an entity.

The new patch is attached.

Mingsong’s picture

Mingsong’s picture

Mingsong’s picture

Status: Needs work » Needs review
Mingsong’s picture

Fix the test errors from #15

Mingsong’s picture

Mingsong’s picture

Issue summary: View changes
Mingsong’s picture

Formatted the comment to match Drupal coding standards