This was a ticket in our internal system before Workbench went to beta on drupal.org
I wrote:
Our description of the "Draft" state is that only the author may see it. However, it seems we are not enforcing this restriction. The "All Recent Content" view at admin/workbench shows unpublished nodes regardless of their state. This is because this View is provided by the primary "Workbench" module and Workbench Moderation does not seem to alter it at all.
Is this a problem? We could set a State != Draft filter dynamically from Workbench Moderation.
Becw responded:
How should we fix this? Should we add a "state != draft" filter to the Workbench "recent content" view? Or should we enforce some sort of node access permission in accordance with the description?
I would prefer that, rather than either of those options, we should change the description text to say something like, "A work in progress." Enforcing privacy for drafts is a possibility for when we have per-state settings, but doesn't make sense given the access control options at this time.
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | 1101874-all-content-unpublished.patch | 10.39 KB | dave reid |
Comments
Comment #1
stevectorI seem to have botched the formatting in the initial post here. Please ignore the italics.
Comment #2
Taxoman commentedSounds like this behaviour should be made optional. Both variants have their use cases, depending on the policy of the actual site.
Comment #3
stevectorA similar question came up here
#1127734: Add option to block creation of new drafts based on moderation state
Comment #4
dave reidWe could just add a default filter of (node.uid = user.uid AND node.published = FALSE) OR (node.uid != user.uid AND node.published = TRUE) ?
Comment #5
dave reidOr just adding the 'Content: Published or admin' filter that is not exposed.
Comment #6
dave reidPatch attached. Initial test worked great, but I'd like to get a simpletest written for it.
Comment #7
dave reid.
Comment #8
dave reid.
Comment #9
caroltron commentedDraft content should not show up in the "All recent content" view. The intention of the "draft" state is that it is still in progress and for the eyes of the author or the maintainers of that content. Recent drafts are easily accessed via the tab in the My Workbench dashboard.
The "All recent content" should be limited to published content by default. Having both published and unpublished in this list is no different that Drupal's core "content list". If it's unpublished, it's unpublished for a reason - to get it off the site. I'd prefer to see us default the "All recent content " list to published, with an easy filter to expose unpublished as well - for those rare cases where a user un-publishes the wrong piece of content, or they change their mind.
Comment #10
stevectorPart of the problem here is Workbench Moderation is not "node access module" in that it doesn't use the {node_access} to limit which nodes show up in lists.
So we can add a filter that would exclude Draft nodes on this View but that won't affect other Views that list unpublished content.
Comment #11
Leeteq commented#10: "it doesn't use the {node_access} to limit which nodes show up in lists"
Can/will Workbench be made to adhere to node_access?
Will it for example play well along with a module like ACL? (and respect it so that it will actually limit lists in accordance to node_access in practise?)
I think this is not only a much needed option, but often something that is presumed my many people to be "obviously in place". To my experience, this is often taken for granted, and thus misunderstood by in particular non-tech users that just want to participate in moderation without having the in-depth knowledge about how it works. (and then later are surprised to find out that it does not adhere to "main security" settings).
IMHO it should at least be possible to force such a module to adhere to node_access.
This has been a long standing "issue" in Drupal's history, and one that I expected would be resolved once the architecture finally supported it, as it now does with D7 along with modules like http://drupal.org/project/acl . Therefore, I think it is important that modules such as Workbench at least gives the option to adhere to the underlying security settings.
Maybe this should be a "feature request"?
(Should I make it one, or has it already been discussed and decided against?)
Comment #12
dave reidThere's no need for Workbench moderation to use the node_access system as any unpublished revision simply has {node}.status = 0 - which is handled automatically by Drupal.
Comment #13
dave reidThere's no need for Workbench moderation to use the node_access system as any unpublished revision simply has {node}.status = 0 - which is handled automatically by Drupal.
Comment #14
Leeteq commentedWell, in #10 its called "part of the problem", and #9 is pointing out that having drafts show up in certain lists is confusing and undesireable. (And this issue is defined as a "bug".)
Different settings may be necessary on different sites, depending on workflow, security, audience, etc.
IMO, "All recent content" should not show unpublished content by default.
It would be practical if the visibility of drafts could be configurable on a per-role basis and even toggled on/off directly on the page after having set the preferred state for all users, and have the option to let each user/role decide if they want to follow the global default for the site or not. Some roles should not be allowed to change that default, others should. I think we need such flexibility to cater for various situations across many sites.
Up until now I have only been monitoring the discussions about this module, while trying to identify which moment it seems appropriate for me to start testing and evaluating them. Getting close now. It looks like this module is one that finally provides what from the perspectives of the projects I am involved in, is critical functionality and flexibility on top of some important architectural changes that came in D6 and D7.
I am looking forward to testing and evaluating this suite of modules once issues such as this one has been resolved.
As these are partly "fundamental" questions regarding possible use cases, I prefer waiting to see which way it goes first.
Comment #15
dave reid.
Comment #16
dave reidChanges fixed with http://drupalcode.org/project/workbench.git/commit/4e7569d:
1. The page view defaults to show only published nodes, but can be filtered to show any or not published.
2. The block views will only show published nodes, and so the 'Published' field is removed from it.
3. Both view displays add a filter on 'Node: Published or Admin' which ensures that the user has access to view an unpublished node in the listing if it is visible.