On the "access control" tab for my "teacher evaluation" content type I have the "teacher evaluations" role checked to "view any content" as well as "view own content". All other check boxes on the page are unchecked. Why would an anonymous user be able to see a page that is of this content type? The way this is configured only a user with the "teacher evaluations" role should be able to see the content. Everybody else should get an "access denied" message. Isn't this correct? Why is this not working? Please help.

Comments

skujan’s picture

As a follow-up, I am able to get Content Access to work in another site I have. Could there be a conflict with another module? Why would it work in one site and not another?

skujan’s picture

Looks like the Content Permissions module conflicts with Content Access. You can only use one or the other.

awasson’s picture

This is a bit late but, no it doesn't conflict with Content Permissions or at least not CCK Content Permissions.

The problem I ran into today is that it requires that you rebuild your permissions before it works and it doesn't always prompt you to do so.

I tried it on a site I'm building but it didn't work... I just wanted one type of content unavailable for Anonymous roles. It didn't work so I poured through the issues queue and didn't find a solution. Then I added it to a vanilla install of D6 that I have (with CCK Content Permissions), installed the module and created my content type. I was prompted to rebuild my permissions. That prompted me to go back to the other site and rebuild my permissions.

After rebuilding my permissions (my-site/admin/content/node-settings) I edited and saved my content type one more time and voila, it works as advertised : )

I hope that helps.

Andrew

PS: Maybe an enhancement for the module would be a link to rebuild the permissions right from a Content Access administration page.

squarecandy’s picture

Category: bug » feature

Thanks awasson!!! that was driving me nuts.

Seems like one of two improvements would be great improvements would be great here:

1) Upon submitting / saving changes on an access control tab, in addition to the "your changes have been saved" message, server a warning "you may need to rebuild your permissions before these changes will take effect." with a link to admin/content/node-settings

2) skip the warning and just call node_access_rebuild upon submitting any form this module serves.

The second one is a more heavy-handed approach, but more secure/foolproof. This is a privacy-focused module after all... Seems like if a site admin realizes that they need to take away permissions from Anonymous users for a certain node type that there's probably a good reason and that they would want the change to take effect immediately, right?

squarecandy’s picture

Title: Anonymous user should not see this content » Message "Permissions have been successfully rebuilt" not true, flag node access permissions to be rebuilt
Category: feature » bug
StatusFileSize
new1.9 KB

I dug in a little deeper here...

I know this module is not under active development, but there are a lot of people using this, and skujan and I can't be the only ones getting confused by this. The module is serving a message "Permissions have been successfully rebuilt for content type..." but it just doesn't seem to be true most of the time... If you go to the admin/content/node-type/TYPE/access page and disable Anonymous user view access for a particular content type, anonymous users can still view it until you rebuild the node access permissions.

Perhaps there's a better solution, but for now, here's a patch that that eliminates the false "success" message and turns on the node_access_needs_rebuild flag that serves a link to where you can rebuild.

good_man’s picture

Title: Message "Permissions have been successfully rebuilt" not true, flag node access permissions to be rebuilt » Make rebuild permissions message more helpful

It does show up a big red alert to rebuild the permissions after enabling it, guess nobody actually see it :)

IMO we should stick to option 1, display the warning again and let the user do that.

@squarecandy: Why the content_access_get_acl_id() function in the patch?

awasson’s picture

It sometimes shows up in a big red alert but not always and that is the reason this was an issue for me. See post #3.

good_man’s picture

Status: Active » Postponed (maintainer needs more info)

I can't reproduce, if you didn't rebuild right away & assigned some grants (changed a content type access settings), it'll rebuild too, so it's working as designed. Any clear steps to reproduce??

dkingofpa’s picture

People can also enable the module via Drush and so don't see that message.

gisle’s picture

Issue summary: View changes
Status: Postponed (maintainer needs more info) » Closed (outdated)