To recreate, do the following:

  1. User alpha creates a new project and creates some releases for the project. User alpha has administrative privileges and sets the status of one of the release nodes to 0 (unpublished).
  2. User alpha gives CVS commit access to user beta via the CVS access tab on the project.
  3. User beta is an authenticated user but has no additional roles. On the site, authenticated users have the following (relevant) permissions:
  • CVS module: Access CVS messages
  • node module: access content
  • project module: access own projects, access projects, maintain projects
  • If user beta goes to the "View all releases" page for the project created in step 1, he will see all of the releases, including the unpublished release.
  • If user beta clicks on the title of the unpublished release, he will get an "access denied" message.

    • Comments

    hunmonk’s picture

    hunmonk commented
    Status: Active » Closed (duplicate)