I am working on a new article and I submit it unpublished. It shows up on the menu for all to see, when normal users click on the link in the menu they get an access denied page. Can we check to see if a user has permissions to access a page, or that the page is published before adding it to the menu?

CommentFileSizeAuthor
#9 node.module.patch664 bytesngroot

Comments

heine’s picture

heine commented
Project: Drupal.org infrastructure » Drupal core
Version: » 6.x-dev
Component: Drupal.org module » menu system
Category: task » feature
Anonymous’s picture

Anonymous (not verified) commented
Category: feature » bug

Am I allowed to mark this as a bug?
Because of the security risk involved, this is a serious issue (IMHO).

See nodes:
http://drupal.org/node/130440
http://drupal.org/node/150313

jpoesen’s picture

jpoesen commented

Confirmed. This behaviour still accours, but I'm not in a position to decide whether this is by design or not.

chx’s picture

chx commented
Version: 6.x-dev » 5.x-dev

There is simply no way this can happen with 6.x -- the very same access check is ran on the menu links when they are displayed and when they are visited. D5 suffers from this and I do not think there's an easy way fixing this.

Anonymous’s picture

Anonymous (not verified) commented

There is now a module that fixes this:
http://drupal.org/project/remove_nonviewable_menu_items

Should be put into core on the 5.x branch.

Petuschki’s picture

Petuschki commented

it is still happening in version 5.5

and: after a user clicks on the link, gets the "access denied" page loaded, it is not possible to login anymore

"q=user"

only shows "Page cannot be found"

I find this very very unpractical ;=(

seanr’s picture

seanr
he/him
commented

Am I the only one who sees this as critical? If we don't want users to see content, it seems fairly obvious that they shouldn't see menu items for that content either. I shouldn't need a module to correct such obvious misbehavior - let's get this fixed.

Anonymous’s picture

Anonymous (not verified) commented

No, you are not alone.
See #2 and #5.

ngroot’s picture

ngroot commented
StatusFileSize
new node.module.patch664 bytes

Adding a call to clear the menu cache in node.module when mass publish or unpublish is done seems to eliminate this behavior for me.

gpk’s picture

gpk commented
Status: Active » Needs review
gpk’s picture

gpk commented
Status: Needs review » Needs work

Code style: actually there should be another space before the "cache_clear_all()".

tr’s picture

tr commented
Status: Needs work » Closed (won't fix)

According to chx in #4 "There is simply no way this can happen with 6.x". This issue is only for Drupal 5.x. As Drupal 5.x is no longer supported, I'm marking this as won't fix.