Prevent delete or allow visibility to unpublished nodes without "administer nodes" permission
For forum purposes, I need my moderators to be able to unpublish forum post nodes and still be able to see them and discuss the contents among themselves.
Problem is, I can't seem to find any way to do that without giving them "administer nodes" permission, which then allows them the ability to delete absolutely any content on the site.
Mini rant: isn't it obvious that these permissions need separation?
I can imagine two solutions:
1. A way to give folks w/o "administer nodes" permission the ability to see unpublished nodes of type x (or even all unpublished nodes)
2. A way to prevent delete ability even for users with "administer nodes" permission, on a role basis (so I can still give delete ability to some)
Is there any solution to this problem other than
a. Modr8 ... which, in its own documentation, says it does not really block access to moderated nodes/comments. It only makes them invisible in the forum (which means anybody who grabbed the url beforehand--or can guess it--can still see them)
b. Abuse module... which seems a bit heavy for what I really need
In my searching I haven't been able to find any other options. Have I missed anything?
A module that adds granularity to delete and/or unpublish permissions in D6 wd be ideal (btw, I hope this problem is addressed in D7?)
Not sure if it will address
Not sure if it will address your needs, but you could look at http://drupal.org/project/workflow_ng or http://drupal.org/project/workflow. They allow you to manage various arbitrary workflow states and give granular permissions for moving through these states
Maybe
Doesn't look like it would work... I could make the forum nodes (have three node types we use in forums) have a workflow state of "review" and give Mods ability to put them into review. The problem is that there doesn't appear to be any ability to make nodes in this state unviewable to anon. or other roles. But maybe I missed that.
Will take a closer look.
(BTW, I'm looking at Workflow. Workflow ng is D5 only and I'm in D6)
No view permission
No, looks like the Workflow permissions apply to who may perform a transition from one state to another... no "view" related permissions.
Publish content
Hi,
http://drupal.org/project/publishcontent might do the trick, although I haven't tried it with forum posts. On nodes (of content types for which it is enabled) it adds a (Un)Publish tab at the top of the page for users with permission, so that they can quickly change the published status without having to go to node/edit.
Thanks. I've actually already
Thanks. I've actually already got that function with Fastoggle, but the problem is when users without "administer nodes" unpublish a node, they can no longer see it. So what's missing is ability to still see the node, edit, etc. while the public cannot view it.
Now that I think about it... if I didn't already mention this idea, "administer nodes per node type" permission would solve the problem completely, since "administer nodes" seems to basically mean "pub, unpub, view unpubed, edit, delete" ... all of that would be fine if I could restrict it to a couple of node types and protect the rest.
I'm going to take a closer
I'm going to take a closer look at this one. Seems like the "publish nodes of type" permission would have no meaning unless the person w/that permission can also see< the node to publish it. Don't see any info on that in the documentation so will have to trial and error.
Pleased to report that
Pleased to report that Publish Content seems to work just fine. Not sure how it works exactly, but roles w/permission to unbpublish a node type can still see it after they unpublish, and republish if they choose... yet they do not have the insanely expansive "administer nodes" permission.
@aharown07: I think this is
@aharown07:
I think this is because you are the author. If another person would unpublish the node, he/she would not be able to see it.
In my setup there is a user who can edit an unpublished node, but not see it! Quite ridiculous.
Actually, it works
No, actually Publish Content is working fine for me. I've tested by logging in with a different account.
I agree, though, that Drupal is desperately in need of more permissions granularity in the core. Haven't been keeping up w/D7, but I hope they'll break up "administer nodes" a good bit... it should be three or four different permission sets.