Disallow access to workflow history to anonymous users

I have the same issue here. Even tried to create a simple workflow but still remain.

Jerzakie, your web site seems to be ok, did you find the solution ?

Best regards,

I was having the same problem, but found this:
http://drupal.org/node/1052176 that points out that the Workflow summary is a View. So if you have your permissions set such that anonymous users can see all views, they're going to be able to see this one.
In my case, I just changed user permissions so that anonymous users cannot see all views, and that worked fine for my site. But perhaps there are cases were the solution will involve more attention to specific views and permissions.

I have found this guy who wrote a patch for workflow.module based on permission ! Work perfectly for me http://drupal.org/node/785194

Hi

Hello, I have the same behaviour: if the node is without a defined author (anonymous) all anonymous users can see the workflow tab (history).
However on my imported content I can't put the author but I would still like my anonymous users to not be able to see the history.
I think this bug refer to the workflow module rather than openpublish.

@sylvaticus
If you edit your workflow, you will find a section specifying who can see the workflow tab on nodes. If "author" is activated, anonymous users will be able to see the workflow tab on any nodes that don't have an author set (because the node was created by "anonymous", so every anonymous user is considered to be the "author")

@Mirroar
Thank you. I understand the logic, however I think that there should be a logic that if author is anonymous and anonymous users are specifically not allowed to see the workflow tab, they should be denied access, whatever they are the "authors" of that specific node.
I don't think this would negativelly impact any different user case.

[edit]Otherwise for the same logic, if author is allowed to make modifications on a node type and one node in anonymous, all anonymous users would be able to edit the node! That's (luckily) not the case in Drupal, so we should just keep the same behaviour with the "see workflow tab" permission :-) [/edit]

Wow, I think that's really a critical issue. My settings allowed "authors" to see the workflow history and suddenly, when I removed the author from a node, the workflow history became public. I think that's very bad - in my case it revealed the title of the node and users that worked on it to the public and also to search engines, although that information shouldn't be accessable!

How can someone else edit anyone's message here?

The following issue has a patch for this problem:
#437874: Every anonymous user has author role access to nodes with 'anonymous' author (D6)