Download & Extend

Access denied when viewing revisions that state has been changed without re-saving content

Project:Workbench Moderation
Version:7.x-1.x-dev
Component:Code
Category:bug report
Priority:major
Assigned:Unassigned
Status:needs work

Issue Summary

As a site administrator or any other user with access to Workbench:

  • Create new node.
  • Save the node contents.
  • Change the state from "Draft" to "In review" using either the box on top of the content or the Moderation tab,
  • Go to the Needs Review tab (admin/workbench/needs-review) – you will see the node title on a list.
  • Click on the title.
  • The link /node/[number]/revisions/[rev_number]/view will be opened.
  • Access denied will appear.

To work-around that issue, a user that submits the content for a review should save it after changing its state.
A reviewer might have a problem accessing it if an editor forgets this step since accessing from "In Review" by clicking on a title won't be possible.

The error goes away after re-saving (after state has been changed) also for the revision viewing link that previously wasn't working (/node/[number]/revisions/[rev_number]/view where rev_number is the number of a first revision).

Is it known error? Are there any other workarounds or patches for that issue?

Comments

#1

Priority:normal» major

This is really a critical bug if useing revisioning, because it leads to a unnecessary new draft to make a publishd draft visible to guests.

#2

I ran into the same problems. With this bug the module is unusable with revisions. The expected behavior is that after set the state to Published the node is directly visible without the need of a second manipulation and the resulting unnessesary Draft. I think there is a bug with the save functionality while changing the state. Is it possible to get more informations in how the things work internaly there to have it more easy to go into the code and possibly writing a patch?

#3

I made a patch to check and correct the access for anonymous users. After that the behaviour is like expected. Maybe that helps.

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-3.patch1.29 KBIdleFAILED: [[SimpleTest]]: [MySQL] Invalid patch format in workbench_moderation-access_denied-1883556-3.patch.View details | Re-test

#4

There was a error in the patch from comment #3 - here is a better one.

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-4.patch806 bytesIdlePASSED: [[SimpleTest]]: [MySQL] 137 pass(es).View details | Re-test

#5

Here is a version of that pacht, that hopefully touches no other permision outside of workbench_moderation.

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-5.patch945 bytesIdlePASSED: [[SimpleTest]]: [MySQL] 137 pass(es).View details | Re-test

#6

Status:active» needs review

This patch look good for me. I took a look to the code and it should not touch other permissions. Thx for the work.

#7

#8

Here is a patch version that will only change the permissions if we are in a node/view context - maybe there is a way to nail it down to nodes that are under workbench-moderation only.

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-8.patch1.28 KBIdleFAILED: [[SimpleTest]]: [MySQL] Invalid patch format in workbench_moderation-access_denied-1883556-8.patch.View details | Re-test

#9

Status:needs review» needs work

The last submitted patch, workbench_moderation-access_denied-1883556-8.patch, failed testing.

#10

Status:needs work» needs review

corrected patch version due to faild test...

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-10.patch912 bytesIdlePASSED: [[SimpleTest]]: [MySQL] 137 pass(es).View details | Re-test

#11

Status:needs review» needs work

Please create Git patches.

#12

Version:7.x-1.2» 7.x-1.x-dev

#13

Status:needs work» needs review

#10: workbench_moderation-access_denied-1883556-10.patch queued for re-testing.

#14

I will provide leonevers patch as a git diff from the dev repo clone of workbench moderation.

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-14.patch1.17 KBIdleFAILED: [[SimpleTest]]: [MySQL] Invalid patch format in workbench_moderation-access_denied-1883556-14.patch.View details | Re-test

#15

Version:7.x-1.x-dev» 7.x-1.2

thx protractor :-)

#16

Status:needs review» needs work

The last submitted patch, workbench_moderation-access_denied-1883556-14.patch, failed testing.

#17

Status:needs work» needs review

Another try with corrected line breaks. Sorry, is also for me the first time I send something here.

AttachmentSizeStatusTest resultOperations
workbench_moderation-access_denied-1883556-17.patch1.03 KBIdlePASSED: [[SimpleTest]]: [MySQL] 137 pass(es).View details | Re-test

#18

Hi,

In my case it hasn't fixed the bug.

What's interesting, the function workbench_moderation_node_access is not even called when viewing a moderated content. (Why?)

I also noted (patch didn't changed it) that moderation status presented within a content (in a small box on top of previewed content) is always an old state, even if changed to a new state (the moderation tab shows the state correctly), until a content is saved again.

#19

Do you have other modules that could have influence to the nodes user access? I tested it with the actual drupal 7 version and Workbench 7.x-1.2 + Workbench Moderation 7.x-1.3+4-dev.

#20

I just udpated to Workbench 7.x-1.2 and Workbench Moderation 7.x-1.3+4-dev (with your patch) and having the same results.

#21

I set up fresh Drupal install (7.19) with just Workbench Moderation and your patch is working!

My problem is that I have custom view that handles couple of more workbench states and the title rendering somehow uses revision number instead of current revision. When using that view in a fresh install the same error occurs.

#22

I had the same problem. After running the patch from #17 revisions and workbench works as expected.
Thanks guys great job.

#23

+++ b/workbench_moderation.module
@@ -440,8 +440,25 @@ function workbench_moderation_permission() {
-  if ($op == 'view' && !$node->status && user_access('view all unpublished content', $account)) {
...
+          && $node->status == '0'

"!$node->status" is the same.

+++ b/workbench_moderation.module
@@ -440,8 +440,25 @@ function workbench_moderation_permission() {
+  if(is_object($node) && isset($node->status)){
...
+    ){
...
+    }
...
+    }

code style

+++ b/workbench_moderation.module
@@ -440,8 +440,25 @@ function workbench_moderation_permission() {
+    if( ¶

trailing space

#24

Version:7.x-1.2» 7.x-1.x-dev
Status:needs review» needs work