Submitted article is visible to everybody before publication.

Confirmed. This is occurring on both 6.x-1.0 and 6.x-1.1. Not a permissions issue -- triple-checked.

TC

I can confirm point a) and have published a 6.x-2.0-dev release with a fix for it.

Regarding point b). This will happen if typed in your address bar the URL to that node (eg .../node/123) . If you then log in as moderator you get that page, as it remember the page from your address bar.
Simply click "My content" after you've logged and you should get the "Pending" tab.

Hope this helps.

The fix is actually in the Module Grants module.

Confirmed this issue as well. Moved to module grants 2.x-dev and problem still exists, even after rebuilding node permissions.

With the 2.x-dev, anonymous users cannot see unpublished nodes, but authenticated users can see unpublished nodes if they have the nid and any other module allows them access to the node. The system does style the content as unpublished.

The fix in module grants 2.x-dev apparently does not solve the problem.

I'm running TAC alongside. I just disabled Revisioning and Module Grants, and it denied access to the unpublished page as normal.

Enabled Revisioning and Module Grants, uncommented the drupal_set_message() debug call at the bottom of module_grants_node_access() and it shows that TAC is allowing view access to the node. This is correct insofar as an uncategorized node is viewable by everyone, but I think the problem here is that Module Grants is ignoring whether or not the user is allowed to view *unpublished* nodes. Viewing unpublished nodes grant should probably take precedence over everything else.

i.e. if the user is allowed to view a particular node normally, but is not allowed to view unpublished content, then the user should be denied access to the node.

Not sure how to approach this one but at least we have a better problem description.

OK, so I had a closer look at this after lunch, and here's what I found.

Currently, the module_grants_node_access() grants permission to view the node if any module grants permission, no matter whether the node is unpublished or not.

The core node_access() denies permission to view unpublished nodes.

With the Author role required to have "view revisions" to do the job, this patch checks the node status and the user's permissions. If the node is unpublished and the user does not have the "view revisions" permission, it denies access to the node. If the user has "view revisions", the node is displayed.

This works fine for my particular installation. RdeBoer, could you evaluate and see if it fits the purpose of the module in general?

Thanks!
--Ogredude

Thanks for the analysis and patch Ogredude!
I've implemented your patch. Actually, it's a slight variation, as the extra test you've added needs to apply also when no additional modules that manipulate the node_access table are installed. So I placed it higher up.
A new 6.x-2.x-dev snapshot (31 March) should be available later today.
Let's run with it for a while and see what reactions we get.
Getting this deep into content access control is bound to have the odd side-effect but I'm determined to get it right!
Rik

Subscribing.