One cannot view but can edit somebody else's unpublished node

I think this is actually by design, and was part of the security fixes in http://drupal.org/node/1557938.

Your user needs both the "Access the content overview page" and the "Bypass content access control" permission to see unpublished nodes there. Though it's odd that you can access them via their URL and not at the overview page. It implies that you already have that permission. Can you check?

@maxiorel,

In some cases User/1 doesn't mean you'll necessarily see something. For example, if block visibility is set by role, user/1 won't see the block unless user/1 is explicitly assigned one of those roles.

This is a case where user/1 should not need Access the content overview page and the Bypass content access control explicitly, in my opinion. But can you test it. Can you specifically assign user/1 Access the content overview page and the Bypass content access control and then check again to see if user/1 can view unpublished content, either on the main content page or the view your created.

Thanks much,

Shai

@maxiorel and all,

I was not able to replicate this problem. What I did:

On a small D7.12 site I navigated to the admin/content and noted that there was one unpublished node. I then updated the site to D7.14. I went back to admin/content and noted that the one unpublished item still appeared in the list. Then I created a new view and filtered for unpublished nodes. The one node showed up there too.

Has anyone been able to replicate what @maxiorel reports?

Shai Gluskin

I unpublished two nodes after I was updated to 7.14 and they are visible to me as user/1.

Hm. Need more info to debug this. Thanks for the testing, folks.

We have similar. upgrade from 7.12 - 7.14. We have a bunch of users whose role previously gave them visibility of their own unpublished nodes. We also use the Content Access Module. Now the users cannot see their own unpublished content.

Today I encountered something similar. Say a user has [NODE_TYPE]: Edit any content, but no Bypass content access control permissions. It appears to be by design (http://drupal.org/node/1106606) that (s)he cannot view somebody else's unpublished nodes (node does not appear at the content overview at admin/content). But (s)he still CAN edit the node through a direct URL like edit/122/edit...

Also see my comment at http://drupal.org/node/1106606#comment-6084946.

Can this be related to your issue?

I was experiencing the same symptom on site built with 7.14. Account uid=1 with all permissions could not see unpublished content on admin/content page. One thing that distinguishes this site from my other D7 sites is the use of the Domain Access module (version 7.x-3.4). When I disable all components of the domain module (I'm using Domain Access, Domain Configuration, and Domain Settings), the symptom disappears and I am able to see unpublished content on the admin/content page. When I re-enable the domain modules, the symptom reappears.

I don't know with absolute certainty that the domain access module is the source of this problem, but all of my testing leads me to believe that it is. So I've filed an issue against the module: http://drupal.org/node/1626874

Turns out that my problem was due to a setting in the domain module... see http://drupal.org/node/1626874 for details.

Im just looking over some postponed bugs.
I cannot reproduce the error using 7.22, #6 could not reproduce the error, and #12's error was caused by a contrib module. I think its safe to close this one.