According to the documentation at http://drupal.org/node/1106606 "By enabling 'View own unpublished content', you grant users access to their own unpublished content." Great, but then how can a user with that permission actually find her own unpublished content?
I have a Drupal 7 site and I created a user, then gave 'Content Editor' and 'Blogger' roles to it. I checked the permissions and those roles have 'View own unpublished content' set. Along with permissions such as 'View the administrative dashboard'. Please see the following screen shots:
http://www.flickr.com/photos/64416865@N00/5736169925/
http://www.flickr.com/photos/64416865@N00/5736720168/
However the user that has only 'Content Editor' + 'Blogger' roles cannot see any link on which she can click to see her unpublished content. I can log in as an administrator, then I see the administrative overlay, I can see the 'Find content' link on top, I can visit /admin/content. But that other user cannot see that administrative overlay and when tries to visit /admin/content then she receives "Access denied You are not authorized to access this page." message.
Am I missing some permissions? Or did I forget some other thing? How can a non-admin user with 'View own unpublished content' permission set actually see the list of her unpublished content items?
Comments
The 'View own unpublished
The 'View own unpublished content' permission only gives permission to the user to view their own unpublished nodes, for example '/node/12', but it does nothing else.
As far as I know, there is no default block that has your 'own unpublished content', but it's very easy to make in a module. Just add a block, use a node access query (note that this is the only correct way of getting nodes in Drupal 7) to request all unpublished nodes for the current user, and provide theming for this list.
For inspiration, have a look at this module: https://github.com/LearningDrupal7Development/single_blog. It's almost completely re-usable.
Then just place the block somewhere on the page.
Alternatively, you could write a module with hook_menu that shows the list in the main content window.
Regards,
Bas
using Views
Well there are two parts to viewing something, the permission to, which you've sorted but then it has to be displayed to the user in 1 of 3 main ways: a View, a page through a menu option (or link) or a block. I don't see any disabled menu options or blocks in D7 to do that but there is a disabled View "Content" which I must admit I have not tried but that may well be the way. Have you done anything with Views yet?
In Drupal 6 I set up my own View for each user to see their own content. Have not tried it in D7 yet.
Julie
Apparently one also needs to
Apparently one also needs to set 'Access the content overview page' permission! So that the user can access admin/content. After enabling that, users with the relevant roles can view items at least by using filters. I must admit that this was not very intuitive at all. :-( (Yes this permission also lets those users to see other types of content, not only their unpublished ones but I could not find any other way (that is without installing the Views module)).
I wouldn't give users
I wouldn't give users permission to access that page if I were you. Creating your own page using hook_menu is very easy. If you are a non-coder, you can try to use the View module and set up a page by selecting all unpublished nodes of that user.
I agree with you now. I
I agree with you now. I switched to using Views, see my latest comment below.
Use Views
Use Views. (Most Drupal sites need Views for something, anyway.) This view I created will add a My Content tab to the user's profile page: http://drupal.org/node/1108312. It works for D6 and D7. It could, of course, be extended to add a Block showing a listing of the user's unpublished content.
I created a similar view
I thought the same thing, so I created a similar view. However, the view won't display unpublished content to users, even if they have the "view own unpublished content" permissions. The view works for admins, but not for users without extensive content access privileges.
Any ideas what I'm doing wrong?
Based on the suggestions here
Based on the suggestions here and realising the security implications of my first solution, I undid it, installed the Views and created a view which shows unpublished blog entries filtered by author = current user. I think this is much more compatible with the 'Drupal way'.
Good choice!
Good choice!
Very good choice!
Very good choice! And definitely the "Drupal Way."
Did it work for you? It isn't for me...
I've been trying to achieve something very similar to what you're after, so I'm curious if you got this working?
I need a view showing a list of an authenticated user's unpublished content of a particular type. It works just as expected if I look at it as an administrator, but even with "View own unpublished content" allowed for authenticated users, the view pulls no results (there should be 2) when I look at it as as one.
However, if the authenticated user accesses the content directly through a URL, then it does show up. I'm guessing there's just something in my view's setup that's conflicting with my intentions.
If you, or anyone else, can think of any reason why this isn't working, I'd greatly appreciate some advice.
Same problem here.
Same problem here.
Before finding this, I started a thread at: http://drupal.org/node/1190096
Found the problem
When I disabled my Simple Access module (thanks to advice from that linked thread), the view worked. Check your node access settings -- that might be causing the issue.
For my view, disabling the node_access settings on the particular view worked for me. This allowed me to keep Simple Access enabled, but turn it off on this particular view. (Be careful, though -- it won't work if you still want node access to function within the View.)
To disable the node_access settings in Drupal 7, on the View, go to Advanced > Query Settings and check the box labeled "disable SQL rewriting."
This also worked for me. I
This also worked for me. I was wondering what security risks come with it though? That warning message in Advanced > Query Options seemed pretty dark (WARNING: Disabling SQL rewriting means that node access security is disabled. This may allow users to see data they should not be able to see if your view is misconfigured. Please use this option only if you understand and accept this security risk.). However I cannot see how anyone could access information that they were not allowed to.
I have my view set to filter in the current user, rather than using arguments. If arguments were used I suppose someone could feasibly access another's content by tweaking the url.... right? But with filters this is not possible...
Any feedback on that. I've been trying like hell to make this work without disabling node access but to no avail. I am developing an online news site, so I cant afford to have site information hacked.
Thanks so much!
allie
This definitely works
It's a strange Views behavior... will NOT show unpublished content, unless that box is ticked.
But tick it and everything works again. whew!
hopefully the security hole is small.
Thank you!
Good grief, that had been bothering me for months! Finally got it fixed thanks to your post. :-)
Thanks for this tip!
Appreciate the tip on disable SQL rewriting! I wanted a list of both published and unpublished content related to a particular node with a reference field. Only the published nodes were showing up, unless you were User 1, even though some other roles had View Own Unpublished Content permissions. You have solved my problem.
You guys might want to look
You guys might want to look at this blog post as well: http://brightbacon.com/blog/drupal/allowing-node-publishingunpublishing-...
In short, the permissions are not really what they say - as users will not see content they create but never publish.
Thanks
It works!
Advanced > Query Settings > "disable SQL rewriting."
It helps me to make correct View for user profile tab.
THANK YOU
Banging my head against a wall for at least an hour until I saw this.
Even with the "View own unpublished content" permission set, and the "Published status" filter removed in views, no results were showing.
Setting Advanced > Query Settings > "disable SQL rewriting" fixed it!!
/chris
The "SQL Rewrite" solution
The "SQL Rewrite" solution did the trick for me three month ago. I tried this again in another view using the same settings but it doesn't work anymore. Has somebody faced this too? Why could this be?