Posted by karlos007 on December 12, 2011 at 4:26pm
6 followers
| Project: | Drupal core |
| Version: | 8.x-dev |
| Component: | node system |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | needs work |
| Issue tags: | needs backport to D7, Needs tests |
Issue Summary
Playing with this module. I want that user can create, edit own, view own. He can not view anything else. How to do that?
If i check: Type: Create new content then user still can not add node.
If I check: View published content then user can add node, but he also can view nodes of other users.
I tried whatever I could but /node/add seem to be depending on "View published content". Why?
Comments
#1
(i am using Domain module can that be problem?)
#2
Hm i made some research.
- All access modules are out.
- User has ONLY permission to create Page content type.
- User has "Access denied" on /node/add/page
Any logic reason for that?
#3
Sorry my fault. Now clean install, Content Access, Domain and everything works well.
Solution: /admin/structure/types/[TYPE]/access - expand Advanced. Give content node grants priority to 10. Flush all caches, rebuild content permissions.
#4
I think this may actually be a bug - perhaps it is by design, but if so I'd like someone to confirm that :)
My use case is this: I want to have people 1) create an account (user role: authenticated) and 2) create a profile (in this case, a node). After a review of their node, their user account gets promoted to one of several other roles, and those elevated roles have permission to "view published content" - but the authenticated user should not have this permission.
From my testing, this is impossible to do without an access control module since access to the node/add page (or any specific node/add/X page) is also controlled by the "view published content" permission.
Is this a mistake?
#5
Okay, I think I found the problem.
There is a check in
node_accessfor 'access content' without checking the $op, and it will always return false, even affecting node/add and node/add/XPatches for 8.x and 7.x attached.
#6
The last submitted patch, core-fix_overly_restrictive_check_on_all_node_ops-1368610-5.patch, failed testing.
#7
This has overlap with #1818556: Convert nodes to the new Entity Field API
Anyway we needs fix tests and add new one
#8
Patches still apply cleanly, and locally the same tests are not failing for me, so re-queueing for more accurate test results.
#9
Whoops, lost important tag.
#10
#5: core-fix_overly_restrictive_check_on_all_node_ops-1368610-5.patch queued for re-testing.
#11
The last submitted patch, core-fix_overly_restrictive_check_on_all_node_ops-1368610-5.patch, failed testing.