The discussions on the subject of fine-grained access control for Drupal have gone around and around and around, and appear to have no end in sight. There are numerous ideas, patches, and contributed modules - none of which seem to have gained whatever level of attention or acceptance is necessary to get them integrated into the core. I'd like to submit a suggestion, so that perhaps we can take a step towards this functionality in 4.4.

The current blog.module provides a mechanism by which some entries can be viewed only by their author. Why can't we extend that notion slightly - to all node types, and implement the notion of "public" and "private" content. That is, do away with the current "anonymous users can view content" option, and force every node to be tagged as either "public" or "private". Public nodes could be viewed by any visitor, and private ones are only visible to registered members. It is critical that this work for all node types - including files and images. I realize this isn't a full-blown groups, roles, or ACL system, but geez - it's a start (and it would make Drupal usable for at least two of my projects).

I admit, I can't contribute any code, but if anyone in a position to make decisions wants to make this happen, I'll test, write docs, send beer - whatever :)...

PatMan

Comments

patman’s picture

Component: other » base system
irwin’s picture

irwin’s picture

Discussion of Permissions and Access Control Requirements for Drupal:

http://drupal.org/node/view/5618

jonbob’s picture

This is now folded into a more encompassing issue: the node-level permissions API.