In my site i've added view own unpublished content permission to a certain rol.

I have a content type with some file fields in it, some of them being private. I can't download those files even if view own unpublished content is set.

Steps to reproduce (edited and expanded)

As administrator

  1. Install Drupal 7.25
  2. Create folder sites/default/private_files
  3. At admin/config/media/file-system, add this as the private file system path
  4. Edit article content type
    1. Uncheck default published status
    2. Add field field_test_file
      1. to Article
      2. with "Upload destination" set to "Private files"
      3. (rest as default)
  5. Create role "editor"
  6. Add permissions:
    1. "View own unpublished content"
    2. "Article: Create new content"
    3. "Article: Edit own content"
  7. Add user test.editor with the role "editor"

As test.editor

  1. Log in and navigate to node/add/article
  2. Add a title and a test file (test.txt)
  3. Save the node
  4. Click the link to the test file
  5. Successfully see the file at system/files/test.txt

Old steps to reproduce

  1. Create a content type with some file fields and tell some of them to upload files to your private files directory
  2. Give your prefered role "view own unpublished content" permission
  3. Create a node of this type, but leave it as "unpublished"
  4. Try to view that node. You'll see all fields info but you'll get an access denied error trying to downloading the file

I'm not a Drupal expert, but i think this is related with the entityFieldQuery performed in file.module

 $query = new EntityFieldQuery();
      $query
        ->fieldCondition($file_field, 'fid', $file->fid)
        ->age($age);
      $references[$field_name] = $query->execute();

Comments

Anonymous’s picture

Anonymous (not verified) commented
Version: 7.x-dev » 8.x-dev

Does this occur in D8?

crevillo’s picture

crevillo commented
Version: 8.x-dev » 7.x-dev

i haven't test d8 yet, sorry. Sorry also for mark this as d8. it was my first issue to drupal and missed that.

anyway, i have more info on this. i was using view_unpublished contributed module and one of the issues there pointed me to this

Applying that patch and rebuilding permissions fixed my issue. let me know if you prefer me to close this request or leave it opened to add more info about d8 or about the behaviour without this view_unpublished moduled activated.

Thank you.

Anonymous’s picture

Anonymous (not verified) commented
Project: Drupal core » View Unpublished
Version: 7.x-dev » 7.x-1.x-dev
Component: file system » Code
Status: Active » Closed (duplicate)

Marking duplicate of #1762904: Fails to respect core 'view own unpublished content' permission and moving to the correct project.

ñull’s picture

ñull commented
Project: View Unpublished » Drupal core
Version: 7.x-1.x-dev » 7.23
Component: Code » file system
Status: Closed (duplicate) » Active

" View own unpublished content" is a core permission. I don't use the module view_unpublished and can reproduce this behaviour. The attached files are treated inconsistent with this permission and therefore a valid core bug.

jp.stacey’s picture

jp.stacey commented
Version: 7.23 » 7.25
Issue summary: View changes
Status: Active » Closed (cannot reproduce)

The original steps to reproduce are too ambiguous to do so reliably. I've expanded them with clear step-by-step instructions for how I've just tested this issue.

Upshot: I can't reproduce this issue on 7.25 core, so I'm closing it as "cannot reproduce". If you think this can be reproduced, just with slightly different steps, then please edit the steps to reproduce above, and reopen the ticket.

hockey2112’s picture

hockey2112 commented

I had a similar issue... I wanted to allow users to upload a "Photo" content node, which contains an image field (which uploads to the private dir). I wanted their new Photo nodes to be unpublished when they are uploaded, so that admins could view and then approve (publish) or deny (delete) the photo. I wanted the users to be able to see their unpublished Photo nodes so that they would know which photos were awaiting approval.

I enabled the "View own unpublished content" permission. This allowed them to view the node itself, but the image from the Image field would not display. The same issue would occur in Views blocks that I created to display a block of those images, even after disabling the SQL rewrite option in the view.

I simply installed the view_unpublished module (https://www.drupal.org/project/view_unpublished). I did not enable any of that module's permissions. Installing that module "magically" allowed those images to display on the nodes and in the View. Not sure how it worked or why, but I am very happy that it does now work.

vmkazakoff’s picture

vmkazakoff commented

confirm that #6 solves issue. i also used module https://www.drupal.org/project/save_draft on my site, and after saving without publishing all images disapearing. now all is working.