The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Not sure if this is an issue but probably just need clarification:
On content-type Foobar, you set pretend View any content, and View own content rights, etc for roles, but also set per-node access control.
now when you goto node 1 (which is a Foobar type)... in the Access Control, why should you be able to set the follow:
View own content, Edit own content, Delete own content.
The node author can always do this right? aka before node_access is checked, Drupal see's if the user is author and if so, grant access.
Is this for setups where you want user to create a News article, and publish it, but not be able to pretend edit (or even view) his content after published? I guess thats the only way it makes sense to me. like if your News module gives a user access to create articles, but after they are created, [if hook_access() doesnt defined the 'edit' op] then node_access is checked.
Comments
Comment #1
fago>The node author can always do this right? aka before node_access is checked, Drupal see's if the user is author and if so, grant access.
No, that's wrong. The node author is only treated special by drupal, if the node is unpublished: then the author can view the node. Else the ".. own .." permissions are applied.