Follow the seven simple steps below to create a basic content publication workflow that will satisfy most of your requirements for revision moderation, using the Revisioning module. Then, if needed, further enhance content security with fine-grained access control through two more tutorials on publication workflow for categorized content with workflow states.

In this first tutorial we'll keep things simple. We'll present a solution to the following common scenario:

Authors write content that prior to being made publicly visible must be reviewed (and possibly edited) by moderators. Once the moderators have published content, authors should be prevented from modifying it while “live”, but they should be able to submit new revisions to their moderators.

What the radio buttons mean:
Modify current revision, no moderation = Publish immediately to the existing revision
Create new revision, no moderation = Publish immediately in a new revision
Create new revision and moderate = Unpublished until approved by moderator

Begin by logging in to your Drupal site as an administrator.

Jump to D7 Instructions

Instructions for D6

1. Install Module Grants and Revisioning as per their README instructions. If you want to compare revisions and highlight the differences, also install the Diff module.
2. Although you do not have to enable the main Module Grants module, it is encouraged that you do, for the reasons given on the Revisioning module home page in the section on "Dependencies". However the submodule Node tools, part of the same Module Grants package, is required for Revisioning.
3. To view revisioned content you have a couple of handy options at your disposal. When you enable Module Grants Monitor a menu option Accessible content will appear in your navigation menu. Role-based access to its various content filtering tabs can be set at User management >> Permissions. When Revisioning is loaded there's an additional useful tab: In draft/Pending moderation. The tab lists all nodes that have revisions more recent than the one currently visible to the public.

   Alternatively, or in addition to the above, installation of Views will give you a Content summary view of all content on your site. You can use this view as is, or you can customize it to suit your needs.

4. You can also configure as a block a cut-down version of the In draft/Pending moderation tab on the Accessible content. This is particularly handy for moderators as the block gets automatically updated with every browser click, so will always display an up to date summary of submitted content requiring review and publication.

   You configure the pending revisions block just like any other block at Administer >>Site building>>Blocks. Configure it so that only the Moderator role may see it. The block doesn't appear until at least one revision has been created on your site. We'll do this further down this page.

5. Under Administer >> Content management >> Content types, click edit next to the content types (Page, Story... etc.) for which you wish to enable/disable revisioning. Under Workflow settings, "Default Options", tick both the "Create new revision" and "New revisions in draft, pending moderation" boxes. Also in this section untick "Published", as we don't want content to be public immediately after creation. Press “Save content type”.
6. Navigate to User management>>Roles to create an Author role and a Moderator role.
7. Under User management>>Permissions assign permission as follows.
   Make sure that “access content” (node module section) has defaulted to anonymous and authenticated users. Switch off “administer nodes” for Author and Moderator (or perhaps all roles) as this gives these roles unrestricted access to all nodes, which defeats our purpose.

   Essential: for the Author role tick "view revisions of own/any type content" for the content type(s) that are subject to moderation, i.e. the content types for which "New revisions in draft, pending moderation" was ticked in step 5. Note: you may use "view revisions" (node module section) instead, just be aware that "view revisions" applies across all content types, thus overriding the fine-grained versions of the revisioning section. Make sure none of the "view revisions..." permissions are ticked for the anonymous user.

   • Give the Author role “create content” and “edit own content” permissions for the desired content types. In the revisioning module section tick the "edit content revisions" permission for Author and Moderator.
   • Give the Moderator the "edit any type content“, "revert revisions”, "view revisions" (or "view revisions of any type content"), “publish revisions”, “unpublish current revision” and "view revision status messages" permissions.
   • You may not want to give any role the “delete revisions” permission, so that a full audit trail is always kept, in that content may be unpublished (removed from public view), but not removed from the database.
   • Finally, under the module_grants and revisioning sections assign permissions to access the content filtering tabs as you see fit. Note that these do not affect access themselves, just permission to use the filtering tabs. The Moderator role would normally have at least "access I Can View", "access I Can Edit", "access All" and "access Pending tab", while for other authenticated users "access I Can View" and "access All" may be sufficient.

   Press “Save permissions”.

8. Create at least one user in the Author role and one in the Moderator role: User management>>Users>>Add user.

That's it. To see if it all works, log in as an Author and Create content, Maybe create a Story, provided you enabled it for moderation in step 5, as a Story goes straight to the front page so can be easily verified. Save. Log out and notice that the new unpublished content isn't visible to the public (anonymous users), yet.

Then log in as a moderator to inspect the revised content queue via the Accessible content>>In draft/Pending moderation tab and/or the "Pending revisions" block, which should now automatically appear. Click on the title of the content and then on the next page, pick the desired (i.e. only) revision by clicking on its saved date. The page that appears next displays the yet unpublished content prepared by the author. Above the content you'll find edit and publish links. Click the publish link and on the next page confirm. Log out to see the now public content.

Log in as an author again, press Accessible content, select the recently created Story and click the Edit tab. You will find that after you (the author) has saved the new revision, the version visible to the public (the current revision) remains unchanged.

Log in as a Moderator once more, select the revised content (pending revision), edit it if you wish and Publish this for all to see. Note that the current revision has now become 'archived' and when you select it you'll find a link to revert to it.

Unpublish?

In most revision moderation scenarios content does not often get unpublished. Rather a different revision (old or recently modified) is made current, while the previous revision is auto-archived.

To remove content (current and all revisions) from public view without deleting it) you have to unpublish the node. You can do this by unticking the appropriate box on the content editing form. It requires the role to have the "administer nodes" permission, which unfortunately also lets the user view, edit and delete any content, a privilege that would obliterate all our good work. For this reason the Revisioning module comes with the "unpublish current revision" permission and link, so that you don't have to give any role the "administer nodes" permission.

Auto-notification of authors upon publication

Taking advantage of the pre-defined triggers of the Revisioning module and the various tokens of the Token Actions module, it is easy to have the system automatically send an email to the author of a revision when a moderator publishes, reverts or unpublishes it.

Make sure that the core Trigger module is enabled on the Administer>>Site building>>Modules page. Then select an advanced action from the drop-down at Site configuration>>Actions, e.g. "Send tokenized e-mail", and configure it. A full list of all tokens available to you (given the modules you've enabled) appears when you click Placeholder tokens at the bottom of the page. Put the [revision-author-mail] token in the recipient field and something like "Your content [revision-title]" in the subject. The body of the email message might look like this:

    Hello [revision-author-name], 

    Moderator [user-name] has just approved and published revision #[vid] 
    of your [type-name] titled "[revision-title]", found at [menu]: [menupath].

    Please email [user-name] ([user-mail]), for further information about this
    publication.

    Regards,

    [site-name] [site-url] [site-slogan]
    [site-date]

Finally, attach your action to the relevant trigger (Site building>>Triggers>>Revisioning).
Now publish a node. The author of the node should get an email. If this doesn't happen, check the logs at Administer>>Reports>>Recent log entries.

Note: should the message "No available actions for this trigger" appear on the Triggers page, install the Trigger Unlock module.

What's still missing?

• In this simple set-up all authors can view each other's content; when you have many authors producing lots of content this may not be good enough and you may want to assign categories to both content and author roles, so that only “sports authors” have access to “sports” content.
  See Revisioning for categorized content (for D6).
• Although Authors can't publish content, they can still edit it after they've saved it, placing it in the care of the moderator for review; conversely a Moderator may (accidently) publish a revision before the Author was done with it. This is because we don't have a separation by content states (“with author”, “with moderator”). This is where the Workflow module comes in. See Revisioning with state-based content access control (for D6).

Instructions for D7

1. Install
   Revisioning as any other module. If you want to compare revisions and highlight the differences, also install the Diff module.
2. For a handy summary of your revisioned content install and enable Views. This should instantly give you a ready-to-use canned view at /content-summary, in your navigation menu. When you visit Structure>>Views page, you'll find details of this revisioning_content_summary view, which you may leave as is or customize to suit your needs. For instance you can move it to another menu, drop or add columns, etc.
3. In addition, you may configure the "pending revisions" block as a supplementary content summary. This block is particularly handy for moderators, as it updates automatically with every browser click, so it will always display an up-to-date summary of recently submitted content requiring review and publication.
   Configure the pending revisions block just like any other block at Structure >>Blocks. Using the Roles link/tab under "Visibility settings" you would normally configure this block so that only the Moderator role may see it. Details of role assignment follow below. The block doesn't appear until at least one revision has been created on your site. We'll do this further down this page.
4. Under Structure>>Content types, click edit next to the content types (Basic page, Article, etc.) for which you wish to enable/disable revisioning. Under Publishing options, "Default Options", tick both the "Create new revision" and "New revisions in draft, pending moderation" boxes. Also in this section untick "Published", as we don't want content to be public immediately after creation. Press “Save content type”.
5. Navigate to People>>Permissions>>Roles to create an Author role and a Moderator role.
6. Under People>>Permissions>>Permissions assign permissions as follows:
   • In the Node module section, switch off "Bypass content access control" for Author and Moderator (or even all roles) as this permission provides almost unrestricted access to all nodes, which defeats our purpose. The "Administer content" permission is less far-reaching in D7 than it was in D6. If you want your moderators to be able to opt in/out of moderation on an ad hoc basis, then you may grant "Administer content" to the moderator role. See the section Opt in/Opt out details.
   • The anonymous user should only have the “View published content” permission.
   • Give the Author role “Content type: Create new content” and “Content type: Edit own content” permissions for the desired content types. Also "View own unpublished content".
   • Give the Moderator the "View content revisions" (or "Content type: View revisions of any content"), "Revert content revisions”, and "Content type: Edit any content“ permissions.
   • In the Revisioning section tick the "Edit content revisions" permission for Author and Moderator.
   • For the Author role tick "Content type: View revisions of own/anyone's content" (Revisioning section) for the content types that are subject to moderation, i.e. the content types for which "New revisions in draft, pending moderation" was ticked. Note: you may use "View content revisions" (Node module section) instead, just be aware that "View content revisions" applies across all content types, thus overriding the fine-grained versions of the revisioning section.
   • Give the Moderator the "View revision status messages", “Publish content revisions (of anyone's content)”, and “Unpublish current revision (of anyone's content)” permissions.
   • Make sure none of the "Content type: View revisions of..." permissions are ticked for the anonymous user.
7. Consider not giving any role the “Delete content revisions” permission, so that a full audit trail is always kept, in that content may be unpublished (removed from public view) but not removed from the database.
8. Press “Save permissions”.
9. Create at least one user in the Author role and one in the Moderator role: People>>List>>Add user.
10. At Configuration >> Text formats make sure that the roles just created can use the text input formats you want them to use. For instance "Full HTML" or "Filtered HTML" only.

That's it. To see if it all works, log in as an Author and Add content, Maybe create an Article, provided you enabled it for moderation, as an Article goes straight to the front page so can be easily verified. Save. Log out and notice that the new unpublished content isn't visible to the public (anonymous users) yet.

Then log in as a Moderator to inspect the revised content queue via the "Pending revisions" block, which should now automatically appear. Click on the title of the content and then on the next page, pick the desired (i.e. only) revision by clicking on its saved date. The page that appears next displays the yet unpublished content prepared by the author. Above the content you'll find edit and publish links. Click the publish link and on the next page confirm. Log out to see the now public content.

Log in as an author again, select the recently created Article from /content-summary and click the Edit tab. You will find that after you (the author) has saved the new revision, the version visible to the public (the current revision) remains unchanged.

Log in as a Moderator once more. After clicking the title of the content in the "Pending revisions" block, you'll find that the content now has two revision. Select the pending (i.e. recently revised) revision, edit it if you wish and Publish this for all to see. Note that the current revision has now become 'archived'. When you select it you'll find a link to revert to it, if necessary.

Revisioning has a number of additional configuration options. You'll find them in two places. Firstly on the Configuration page, under the Content authoring section, secondly for each of the content types at Structure>>Content types>>edit, Publishing options, "Create new revision" fieldset. They're all self-explanatory. Have a look and see if any apply to your use-case.

Tip: a quick way to make the /content-summary view appear in the admin, rather than the public theme is to change in the Views UI the URL to /admin/content-summary. Or use the handy Page theme module.

Opt in/Opt out

With the "Administer content" permission being less far-reaching in D7 than "administer nodes" was in D6, you can now confidently give selected roles the permission to opt-in or opt-out of content moderation on a per-edit basis. So, for instance, if at Structure >> Content types >> edit the content type Article has not been configured to be subject to moderation by default, then the roles with the "Administer content" permission may, at any point, decide to switch moderation on, simply by pushing a radio button on the Article content edit form.

Unpublish?

In most revision moderation scenarios content does not often get unpublished. Rather a different revision is made current while the previous revisions is auto-archived.

To remove a piece of content (current and all revisions) from public view without deleting it, you have to unpublish the node. You can do this by unticking the appropriate box on the content editing form. This requires the role to have the "Administer content" permission, which also grants access to a few more options. If you don't want to do this, give the role the more fine-grained "Unpublish current revision" permission instead. Content may then be unpublished from the Revisions tab that sits next to the View tab.

Auto-notification of authors upon publication

Taking advantage of the pre-defined triggers of the Revisioning module and the various tokens of core, it is easy to have the system automatically send an email to the author of a revision when a moderator publishes, reverts or unpublishes it.

Make sure that the core Trigger module is enabled on the Structure>>Modules page. Then select an advanced action from the drop-down at Configuration>>Actions, e.g. "Send e-mail...", and configure it. A full list of all tokens available to you (given the modules you've enabled) will be available at the bottom of your action configuration page, provided you have also installed and enabled the Token module. This module also provides additional tokens, such as [content-type:name], not available in core.

Put the [revision:author:mail] token in the recipient field and something like "Your content [revision:title]" in the subject. The body of the email message might look like this:

    Hello [revision:author:name], 

    Moderator [user:name] has just approved and published revision #[revision:vid] 
    of your [node:type] titled "[revision:title]", found at [node:url].

    Please email [user:name] ([user:mail]), for further information about this
    publication.

    Regards,

    [site:name] [site:url] [site:slogan]
    [date:medium]

Finally, attach your action to the relevant trigger (Structure>>Triggers>>Revisioning).
Now publish a node. The author of the node should get an email. If this doesn't happen, check the logs at Reports>>Recent log entries.