I tried to set up the workflow and workflow_access modules on a site already using Taxonomy Access Control, but I believe TAC may be overriding/interfering with access restrictions set by workflow_access. In particular...

1. Created the flow "Story Workflow" with states Draft and Published, and attached it node type Story.
2. Gave anonymous users permission to view posts in Published state, but not in Draft state.
3. However, because TAC is also in use, the posts (Draft or Published) are attached to a vocabulary (Subject) where view permission is granted to anonymous users.

I believe the last detail is causing TAC to override the access restrictions, allowing anon users to see posts in Draft state.

I can't change TAC view permissions to Ignore on the category Subject, since terms in that category are also attached to node types that don't have a work flow (e.g. Blog entries), and TAC defaults to deny on nodes that only have the "Ignore" bits set.

Does granting View permissions on categories thru TAC will override any restrictions set by workflow_access?

Finally, I did make sure nodes with workflow states attached all had their published bits set, as per this thread...
http://drupal.org/node/156028

Comments

westbywest’s picture

westbywest commented

I am using Drupal v5.2, PHP v5.2.0-8+etch7, Apache v2.2.3-4, and MySQL v5.0.32-7etch1 under Debian Etch.

Bastlynn’s picture

Bastlynn commented
Status: Active » Closed (won't fix)

Hi,

With the release of Drupal 7, Drupal 5 is no longer receiving security updates, reviews, or development from many contributed modules. Since 5 is now considered a depreciated version, you really should seriously look into upgrading to Drupal 6 or 7. The newer versions of Drupal work better, have more support, and will be safer (literally! security patches!) for your website. We are currently working on a new release for Workflow to Drupal 7. In light of that, further support for Drupal 5 issues is infeasible at the moment. Please consider upgrading to Drupal 6 or 7 in the near future - you'll be glad you did.

- Bastlynn

Node access modules rarely play well together - please recall that access if additive not subtractive. If *any* module says the user can view the node, then the user can view.