Hello guys, i'm experiencing an issue when "embedding" a view in a node. Regardless of the group the user belongs to and the group a content type is assigned to, the users (even members of the group) will not be able to see the block coming from views, unless the node is published.

What i see is that the row that workbench_moderation_og is adding to the database for a node is having a "workbench_moderation_og" realm. When i use views, and the user doesn't have "View all unpublished content" permission, if the node is not published (status = 1), no user will be able to see the block.
This is because views is adding a WHERE where it looks for the "og_access:node" realm:

WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = ['groupId']) AND (na.realm = 'og_access:node') ))AND (na.grant_view >= 1) AND (node.nid = na.nid) ))

and basing on what i see this row will never be there, as long as the node is unpublished i only see the workbench_moderation_og row giving grants, when the node is published i see a row with gid = 0 and "all" as the realm (this is really confusing, since the node type is assigned to a specific group i would expect its gid to appear when it is about giving grants to users).

So, when the node is published the
WHERE (( (na.gid = '0') AND (na.realm = 'all') )
is triggered and the block is visible to ANY user, regardless of specific access control rules, they can be unpublished but if there's no filter for published set in views they will appear anyhow.

I know it all sounds confusing, it's not that easy also for me to explain, but it looks like workbench_moderation_og is making it possible to access unpublished nodes to users with grants on the group the node is handled by but it misses integration with views, so that the realm it sets in the node_access table is not taken in any consideration by views, and therefore the blocks created by views will never be visible unless the node is published.

The goal is to make blocks generated by views visible in unpublished revisions of nodes belonging to a certaing group that the user is part of, a group he has grants on.
Thanks.

Comments

planctus created an issue. See original summary.

planctus’s picture

planctus commented
Issue summary: View changes
planctus’s picture

planctus commented
Status: Active » Closed (works as designed)

I close this issue myself, i went digging a bit and i better understood the node access system, the assumptions i made before were incorrect, the title of the issue is already misleading. It is now clear to me that the subquery performed on the node_access table is not provided by views itself, but from node and it's based on the implementations of hook_node_grants() by the different modules and workbench_moderation_og has its own implementation of this hook, all good.
I close it as "work as designed" because this is what it is :)
Thanks