Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.I have a similar need to : #1597360 so I try to explain my use case :
- An authenticated user created a new node "Guest" which is in unpublished state and in the first step "Draft" of the workflow
- I need to send the link of this node (I use unique random path) to a guest - so Anonymous Role - in order Anonymous to fill the node and publish the node. When the node is publish by the guest, it comes to the second state of the workflow "publié"
(I do this with Rules)
(I need unpublished and published state of a node because I use SaveDraft module, to bypass required field in save unpublished mode)
So, if in global permissions I allow anonymous to edit any node "Guest", even if in Access Control I disallow Anonymous to view or edit the node for the second step of Workflow, Anonymous can view and edit any node "Guest".
And if in global permissions I disallow anonymous to edit any node "Guest", even if in Access Control I allow Anonymous to edit/view the node, Anonymous can't view or edit the node.
Thanks
sim
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | 437874-anonymous-access-workflow-7.x-1.2.patch | 2.86 KB | bdimaggio |
Comments
Comment #1
nancydruSince you didn't mark this against the dev version, I have to ask if you have tried that first.
As stated at the bottom of the access page, "Edit any xxx" permission will override Workflow Access.
Drupal has a permission to allow anonymous viewing of unpublished nodes. I think that check happens before WA even has a chance to approve the access.
Comment #2
kiricou commentedThanks for the tip
I upgrade to 7.x-1.2 and my use case is working
But even if Anonymous user has "Edit Any" permission for my content type, Workflow access restrictions are applied.
Strange because of this note, in the WorkflowAccess admin tab.
"WARNING: Use of the "Edit any," "Edit own," and even "View published content" permissions for the content type may override these access settings."
Comment #3
nancydru"may override" also implies it might not. In my big site, it did. Apparently in your site, it doesn't.
Comment #4
johnvPlease check out 7.x-2.x, where the following issue was committed:
#437874: Every anonymous user has author role access to nodes with 'anonymous' author (D6)
Comment #6
bdimaggioIn case anyone runs into this and is stuck on version 7.x-1.2, I've attached a patch that adapts TravisCarden's patch from issue #437874 for that version.